{"data":{"id":"75363bad-012f-497f-a0bf-c5e8be0221cc","title":"GHSA-83x6-42hr-jc76: CKAN MCP Server: MQA server allowlist bypass via unanchored regex (`isValidMqaServer`)","summary":"A vulnerability in the CKAN MCP Server allows attackers to bypass a security check that restricts certain tools to only use `dati.gov.it`. The validation uses an unanchored regex (a pattern that doesn't fully check where the text ends), allowing URLs like `https://dati.gov.it.attacker.com` or `https://dati.gov.it@attacker.com` to pass the check while actually connecting to attacker-controlled servers. This lets attackers intercept requests, spoof responses, and potentially inject malicious content into the AI model's answers.","solution":"The source recommends validating the parsed host instead of the raw string: use `new URL(serverUrl)` to parse the URL, then verify the hostname equals either `dati.gov.it` or `www.dati.gov.it` (in lowercase). The source states: 'Anchoring the regex end-to-end (`/^https:\\/\\/(www\\.)?dati\\.gov\\.it(\\/|$)/i`) also closes the suffix trick, but URL-parsing + exact host comparison is the robust fix and also neutralizes the `@`-userinfo variant.'","labels":["security"],"sourceUrl":"https://github.com/advisories/GHSA-83x6-42hr-jc76","publishedAt":"2026-09-02T14:52:21.000Z","cveId":"CVE-2026-73845","cweIds":null,"cvssScore":null,"cvssSeverity":"medium","severity":"medium","attackType":["prompt_injection"],"issueType":"vulnerability","affectedPackages":["@aborruso/ckan-mcp-server@< 0.4.112 (fixed: 0.4.112)"],"affectedVendors":["LangChain"],"affectedVendorsRaw":["CKAN","CKAN MCP Server"],"classifierModel":"claude-haiku-4-5-20251001","classifierPromptVersion":"v3","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00224,"patchAvailable":true,"disclosureDate":"2026-09-02T14:52:21.000Z","capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["integrity","confidentiality"],"aiComponentTargeted":"agent","llmSpecific":true,"classifierConfidence":0.85,"researchCategory":null,"atlasIds":["AML.T0051"]}}