GHSA-3xm7-qw7j-qc8v: SSRF in @aborruso/ckan-mcp-server via base_url allows access to internal networks

Summary

The @aborruso/ckan-mcp-server MCP server accepts a base_url parameter in tools such as ckan_package_search and sparql_query and sends HTTP requests to it without restriction. Exploitation needs prompt injection through malicious content while the assistant has this server connected, and a proof of concept sent 9 requests to a canary endpoint. An attacker could scan internal networks, steal cloud metadata credentials via 169.254.169.254, and attempt SQL or SPARQL injection.

Mitigation

Recommended fix: 1. Validate base_url against a configurable allowlist of permitted CKAN portals. 2. Block private IP ranges (RFC 1918, link-local). 3. Block cloud metadata endpoints (169.254.169.254). 4. Sanitize SQL input for datastore queries. 5. Apply a SPARQL endpoint allowlist.

Topics

• Model Context Protocol

Related items

• InfoTop agent skill security resources — November 2026Similar attack · Adversa AI Blog
• InfoHow to Turn AI Red Team Findings Into Runtime ControlsSimilar attack · Straiker Blog
• MediumDocker Sandboxes vulnerability lets AI agents access sensitive files outside their sandbox (CVE-2026-103916) | Endor LabsSimilar attack · Endor Labs Blog
• MediumFree the Model, Sell the Gateway: Prompt Adware hidden in Jailbreak BundlesSimilar attack · Check Point Research
• InfoRight Tool, Wrong Parameters: Defending LLM Agents Against Parameter PoisoningSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)