CVE-2026-73844

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-73844
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-73844.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-73844
Aliases
Published
2026-08-14T16:41:42Z
Modified
2026-10-28T02:31:13Z
Severity
  • 3.7 (Low) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N CVSS Calculator
Summary
CKAN MCP Server: Information disclosure via verbose error reflection
Details

CKAN MCP Server is a tool for querying CKAN open data portals. Prior to 0.4.112, error paths reflect raw upstream response bodies and internal exception messages back to the caller instead of a sanitized, generic message. When the server is pointed at (or redirected/SSRF'd to) a host that returns a non-CKAN response, or when an internal exception occurs, the caller receives verbatim upstream content and internal detail (hostnames, internal IPs, DB errors, stack fragments). This vulnerability is fixed in 0.4.112.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-209",
        "CWE-210"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/73xxx/CVE-2026-73844.json"
}
References

Affected packages

Git / github.com/ondata/ckan-mcp-server

Affected ranges

Type
GIT
Repo
https://github.com/ondata/ckan-mcp-server
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
3b827af72b228d42aa7b0d7dac5347d16af3f4e5
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "fixed": "0.4.112"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StringRangeExpression"
        },
        {
            "range": [
                {
                    "fixed": "3b827af72b228d42aa7b0d7dac5347d16af3f4e5"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "original_tag": "v0.4.112",
            "range": [
                {
                    "fixed": "3b827af72b228d42aa7b0d7dac5347d16af3f4e5"
                }
            ],
            "source": "REFERENCES_TAG"
        },
        {
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "fixed": "0.4.112"
                }
            ],
            "source": "DESCRIPTION"
        }
    ]
}

Affected versions

v0.*
v0.3.0
v0.3.1
v0.3.2
v0.4.0
v0.4.1
v0.4.10
v0.4.100
v0.4.101
v0.4.102
v0.4.103
v0.4.105
v0.4.106
v0.4.107
v0.4.108
v0.4.11
v0.4.12
v0.4.13
v0.4.14
v0.4.15
v0.4.16
v0.4.17
v0.4.18
v0.4.19
v0.4.2
v0.4.20
v0.4.21
v0.4.22
v0.4.23
v0.4.24
v0.4.25
v0.4.26
v0.4.27
v0.4.28
v0.4.29
v0.4.3
v0.4.30
v0.4.31
v0.4.32
v0.4.33
v0.4.34
v0.4.35
v0.4.36
v0.4.37
v0.4.38
v0.4.39
v0.4.4
v0.4.40
v0.4.41
v0.4.42
v0.4.43
v0.4.44
v0.4.45
v0.4.46
v0.4.47
v0.4.48
v0.4.49
v0.4.5
v0.4.50
v0.4.51
v0.4.52
v0.4.53
v0.4.54
v0.4.55
v0.4.56
v0.4.57
v0.4.58
v0.4.59
v0.4.6
v0.4.60
v0.4.61
v0.4.62
v0.4.63
v0.4.64
v0.4.65
v0.4.66
v0.4.67
v0.4.68
v0.4.69
v0.4.7
v0.4.71
v0.4.72
v0.4.73
v0.4.74
v0.4.75
v0.4.76
v0.4.77
v0.4.78
v0.4.79
v0.4.8
v0.4.80
v0.4.81
v0.4.82
v0.4.83
v0.4.84
v0.4.85
v0.4.86
v0.4.87
v0.4.88
v0.4.89
v0.4.9
v0.4.90
v0.4.91
v0.4.92
v0.4.93
v0.4.94
v0.4.95
v0.4.96
v0.4.97
v0.4.98
v0.4.99

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-73844.json"