GHSA-78x9-fhhx-v2g6: CKAN MCP Server: Cache-key canonicalization collision enables cache confusion / poisoning

Summary

The CKAN MCP Server response cache builds its key from an ambiguous serialization of request parameters, because canonicalizeParams does not escape the & and = delimiters or the | separator used in buildCacheKey. Two distinct parameter sets can therefore produce the same key, so an attacker who primes a colliding entry on a shared cache can cause another client's different query to receive the attacker's cached response.

Mitigation

Build the cache key from an unambiguous, injection-proof encoding: hash a structured, canonical JSON with typed values, or percent-encode or escape each key and value before joining, using a separator that cannot appear in the encoded fields. Include a type tag so object and string values never coincide. Consider partitioning the cache per client or tenant on shared deployments.

Topics

• Model Context Protocol

Related items

• InfoTop agent skill security resources — November 2026Similar attack · Adversa AI Blog
• InfoHow to Turn AI Red Team Findings Into Runtime ControlsSimilar attack · Straiker Blog
• MediumDocker Sandboxes vulnerability lets AI agents access sensitive files outside their sandbox (CVE-2026-103916) | Endor LabsSimilar attack · Endor Labs Blog
• MediumFree the Model, Sell the Gateway: Prompt Adware hidden in Jailbreak BundlesSimilar attack · Check Point Research
• InfoRight Tool, Wrong Parameters: Defending LLM Agents Against Parameter PoisoningSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)