AI Sec Watch: A Security Intelligence Platform for AI Systems

Luu, T.J.

GHSA-83x6-42hr-jc76: CKAN MCP Server: MQA server allowlist bypass via unanchored regex (`isValidMqaServer`)

mediumvulnerabilityLLM-Specific

security

Source: GitHub Advisory DatabaseSeptember 2, 2026CVE-2026-73845

Summary

A vulnerability in the CKAN MCP Server allows attackers to bypass a security check that restricts certain tools to only use `dati.gov.it`. The validation uses an unanchored regex (a pattern that doesn't fully check where the text ends), allowing URLs like `https://dati.gov.it.attacker.com` or `https://dati.gov.it@attacker.com` to pass the check while actually connecting to attacker-controlled servers. This lets attackers intercept requests, spoof responses, and potentially inject malicious content into the AI model's answers.

Solution / Mitigation

The source recommends validating the parsed host instead of the raw string: use `new URL(serverUrl)` to parse the URL, then verify the hostname equals either `dati.gov.it` or `www.dati.gov.it` (in lowercase). The source states: 'Anchoring the regex end-to-end (`/^https:\/\/(www\.)?dati\.gov\.it(\/|$)/i`) also closes the suffix trick, but URL-parsing + exact host comparison is the robust fix and also neutralizes the `@`-userinfo variant.'