{"data":{"id":"2a20473a-40c0-4fe4-839b-7c3c3d3cf1d2","title":"GHSA-78x9-fhhx-v2g6: CKAN MCP Server: Cache-key canonicalization collision enables cache confusion / poisoning","summary":"The CKAN MCP Server has a cache-key collision vulnerability where different parameter sets can produce the same cache key, allowing an attacker to poison the cache (store malicious data in it) so that other users receive wrong results. The problem occurs because the cache key creation doesn't properly escape special characters like '&' and '=', so two genuinely different queries can be treated as identical and share the same cached response.","solution":"The source recommends: 'Build the cache key from an unambiguous, injection-proof encoding: hash a structured, canonical JSON (with typed values) or percent-encode/escape each key and value before joining, and use a separator that cannot appear in the encoded fields. Include a type tag so `{a:{...}}` (object) and `{a:\"...\"}` (string) never coincide.' Additionally, 'Consider partitioning the cache per client/tenant on shared deployments so one client cannot influence another's entries.'","labels":["security"],"sourceUrl":"https://github.com/advisories/GHSA-78x9-fhhx-v2g6","publishedAt":"2026-09-03T14:49:22.000Z","cveId":"CVE-2026-73846","cweIds":null,"cvssScore":null,"cvssSeverity":"medium","severity":"medium","attackType":["rag_poisoning"],"issueType":"vulnerability","affectedPackages":["@aborruso/ckan-mcp-server@< 0.4.112 (fixed: 0.4.112)"],"affectedVendors":["LangChain"],"affectedVendorsRaw":["CKAN MCP Server"],"classifierModel":"claude-haiku-4-5-20251001","classifierPromptVersion":"v3","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00137,"patchAvailable":true,"disclosureDate":"2026-09-03T14:49:22.000Z","capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["integrity"],"aiComponentTargeted":"rag","llmSpecific":false,"classifierConfidence":0.78,"researchCategory":null,"atlasIds":["AML.T0020","AML.T0051.001"]}}