CVE-2026-61612: @aborruso/ckan-mcp-server SSRF via DNS-name to Internal IP - Incomplete Fix
Summary
CVE-2026-61612: @aborruso/ckan-mcp-server has SSRF via DNS-name → internal IP — incomplete fix of CVE-2026-53509. Affects @aborruso/ckan-mcp-server versions < 0.4.108. Fixed in 0.4.108. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The @aborruso/ckan-mcp-server is a Node.js package designed to facilitate interactions with CKAN (Comprehensive Knowledge Archive Network) through a microservice architecture. It allows users to manage and query datasets efficiently. However, the package has a significant vulnerability that exposes it to Server-Side Request Forgery (SSRF) attacks, allowing unauthorized access to internal network resources.
Vulnerability Detail
The vulnerability arises from the SSRF guard 'validateServerUrl', which only checks the hostname string without resolving DNS. This oversight allows any user-supplied 'server_url' whose hostname resolves to an internal address to bypass the guard, leading to potential requests to loopback addresses and cloud metadata services (e.g., 169.254.169.254). This vulnerability is a third bypass of the same guard, which has not been adequately addressed in previous patches. The impact is severe, especially for self-hosted deployments using unauthenticated HTTP transport, as it enables remote clients to access sensitive internal resources directly.
How To Fix
Minimum fixed version
0.4.108
This is the first release that contains the fix.
npm install @aborruso/ckan-mcp-server@0.4.108Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can restrict access to the self-hosted HTTP transport by implementing an allowlist of valid domains using the 'CKAN_ALLOWED_DOMAINS' environment variable. This will help mitigate the risk until a full patch is applied.
Conclusion
The @aborruso/ckan-mcp-server package has a critical SSRF vulnerability that allows attackers to access internal resources. It is essential to update to the patched version 0.4.108 or implement workarounds to mitigate the risk. Regular monitoring using tools like Vulert can help maintain security in open-source projects.
See every vulnerability recorded for @aborruso/ckan-mcp-server →
FAQ
Server-Side Request Forgery (SSRF) is a vulnerability that allows an attacker to send crafted requests from a vulnerable server to internal or external resources, potentially exposing sensitive data.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
The vulnerability can lead to unauthorized access to internal services, including cloud metadata services, which may expose sensitive information such as IAM credentials.
Yes, a patch is available in version 0.4.108 of the @aborruso/ckan-mcp-server package. It is recommended to update to this version to mitigate the vulnerability.
If immediate updates are not possible, implement domain allowlisting using the 'CKAN_ALLOWED_DOMAINS' environment variable to restrict access to the HTTP transport.
References
Related vulnerabilities
Recent vulnerabilities recorded for @aborruso/ckan-mcp-server.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
