What happened
Published 2026-09-21. This is the third bypass of the same guard, and strictly worse than CVE-2026-53509: it reaches cloud metadata (IMDS) in addition to loopback.
Why it matters
In a cloud-deployed AI/MCP environment, SSRF to 169.254.169.254 can expose instance-role credentials to the agent/tool — turning a data-portal MCP tool into a cloud-credential exfil channel.
Attack vector
The validateServerUrl SSRF guard (previously patched for CVE-2026-33060 / CVE-2026-53509) validates only the hostname string and never resolves DNS, so a hostname resolving internally bypasses the block. An agent can be steered to send requests to instance metadata.
Affected systems
ondata/ckan-mcp-server (CKAN MCP Server) < 0.4.108
Mitigation
Upgrade to v0.4.108 (commit bb7439b5; GHSA-798p-78g2-v556).