GHSA-83x6-42hr-jc76: CKAN MCP Server: MQA server allowlist bypass via unanchored regex (`isValidMqaServer`)

Summary

The `ckan_get_mqa_quality` and `ckan_get_mqa_quality_details` tools in the CKAN MCP Server limit `server_url` to `dati.gov.it` using an unanchored regex in `isValidMqaServer`. URLs such as `https://dati.gov.it.attacker.com/x` and `https://dati.gov.it@attacker.com/x` pass validation, so the tools send requests to attacker-controlled hosts and return their responses to the caller.

Mitigation

Validate the parsed host instead of the raw string: parse the URL with `new URL()`, require the `https:` protocol, and compare `hostname` exactly against `dati.gov.it` or `www.dati.gov.it`. Anchoring the regex end-to-end (`/^https:\/\/(www\.)?dati\.gov\.it(\/|$)/i`) also closes the suffix trick, but URL parsing with exact host comparison is the robust fix and also neutralizes the `@`-userinfo variant.

Topics

• Model Context Protocol

Related items

• MediumCVE-2026-122235: Jan workspace guard bypass allows file writes outside workspace via symlinksSimilar attack · NVD/CVE Database
• HighCVE-2026-122135: Mistral Vibe remote code execution via repository gpg.program settingSimilar attack · NVD/CVE Database
• HighCVE-2026-122134: Mistral Vibe remote code execution through malicious Git filter driversSimilar attack · NVD/CVE Database
• HighCVE-2026-122133: Mistral Vibe untrusted search path code execution via git.exe on WindowsSimilar attack · NVD/CVE Database
• MediumCVE-2026-121936: easyVoice server-side request forgery through openaiBaseUrl in /api/v1/ttsSimilar attack · NVD/CVE Database