CVE-2026-53509: @aborruso/ckan-mcp-server: SSRF via base_url allows access to internal networks (Potential fix bypass of CVE-2026-33060)

Tools such as ckan_package_search and sparql_query take a caller-supplied CKAN server URL and make HTTP requests to it. After CVE-2026-33060, src/utils/http.ts checked only the parsed hostname string: it blocked localhost, dotted IPv4 literals and bracketed IPv6 literals. The names ip6-localhost and ip6-loopback fit none of those patterns, yet on many Linux hosts they resolve to ::1 through /etc/hosts. A request to them passes the filter and reaches the loopback interface.

A remote MCP caller, which can mean an AI agent steered by a prompt injection, can therefore make the server connect to local or private addresses. When the target answers with CKAN-shaped responses, the caller receives data derived from them. That limits the read path, but it can still expose internal CKAN-like APIs and probe internal services. The CVSS vector needs low privileges and user interaction, and rates confidentiality impact high.

Affected: npm package @aborruso/ckan-mcp-server below 0.4.106. Any deployment where an MCP client, or an agent that talks to it, can supply the server URL to CKAN tools is exposed. Check the version:

npm ls @aborruso/ckan-mcp-server

For a global install, use npm ls -g @aborruso/ckan-mcp-server.

Upgrade to 0.4.106.

npm install @aborruso/[email protected]

The fix (commit c761045) replaces the single hostname === 'localhost' comparison with a blocked-hostname set that includes ip6-localhost and ip6-loopback. The release notes report no breaking changes. The advisory names no workaround. Until you upgrade, run the server without access to internal networks, using egress rules.

Check the server's outbound request logs for CKAN tool calls whose target host is ip6-localhost, ip6-loopback, or another name that resolves to a private address. Review MCP client logs for ckan_package_search or sparql_query calls with unfamiliar server URLs. On the network side, look for connections from the MCP host to loopback or internal ranges that match those calls.

Summary

A known vulnerability CVE-2026-33060 indicated tools including ckan_package_search and sparql_query that accept a base_url parameter had the risk of making HTTP requests to arbitrary endpoints without restriction. A fix was applied to filter out ip addresses. However, a method to bypass exists.

Details

CKAN MCP Server validates caller-supplied CKAN server URLs by inspecting only the parsed hostname string before issuing outbound HTTP requests. In src/utils/http.ts, hostname aliases such as ip6-localhost are not equal to localhost, are not dotted IPv4 literals, and are not bracketed IPv6 literals, so they pass the SSRF filter but can resolve to loopback when the server performs the request. A remote MCP caller that can invoke CKAN tools with a server_url can therefore make the server connect to local or private addresses and, for CKAN-shaped responses, receive response-derived data.

Fix

Replaced the single hostname === 'localhost' check with a blocked-hostname Set covering ip6-localhost and ip6-loopback. Patched in commit c761045a1b7c5f40d2626540dd2ef1d4feb91f8c.

--- @aborruso/ckan-mcp-server thanks hibrian827 for responsibly disclosing this issue.