Skip to content
AI Sec Watch
LowVulnerability

GHSA-vqff-r82h-9crc: ckan-mcp-server: DataStore Table UI resource does not validate postMessage origin (in) and posts to targetOrigin "*" (out)

Source
GitHub Advisory(opens in a new tab)
Identifiers
CVE-2026-76894GHSA-vqff-r82h-9crc
Published
Record updated
View JSON
Affected
  • @aborruso/ckan-mcp-server < 0.4.112
Fixed in
0.4.112
Known exploitation
Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.

Summary

The ckan-mcp-server DataStore Table UI resource, rendered as an MCP Apps iframe in src/resources/datastore-table-ui.ts, accepts window message events without checking event.origin and sends outbound postMessage calls with target origin '*'. Any frame that can reach the document can inject fabricated fields or records, including phishing links, and can spoof responses to pending MCP requests such as ui/initialize. The advisory rates this Low because exploitation depends on the host embedding model, and it is framed as a hardening issue.

Mitigation

Validate event.origin against the expected host origin on every inbound message and drop messages from other origins. Send outbound postMessage calls with an explicit target origin, the host origin established at initialize time, instead of '*'. Optionally bind the channel to a nonce or identifier established during ui/initialize so that only the negotiated host can drive the panel.

Topics

Related items