What happened
NVD published CVE-2026-73846 (CVSS 6.5, Medium) and CVE-2026-73845 (CVSS 5.3, Medium) on 2026-08-14, describing a cache-key collision vulnerability and a hostname-validation bypass in CKAN MCP Server's data-quality checking tools.
Why it matters
Low blast radius — a single niche open-data MCP integration — but represents the broader pattern of insufficiently validated hostname/URL checks in MCP tool implementations that can be chained toward SSRF or data leakage.
Attack vector
CVE-2026-73846: canonicalizeParams serializes request parameters with unescaped delimiters allowing cache-key collisions and cross-request cache poisoning; CVE-2026-73845: isValidMqaServer uses a prefix-only regex for dati.gov.it validation, allowing suffix-hostname bypass for SSRF-adjacent access
Affected systems
CKAN MCP Server < 0.4.112
Mitigation
Upgrade CKAN MCP Server to 0.4.112 or later