CVE-2026-73844: @aborruso/ckan-mcp-server Information Disclosure via Verbose Error Reflection
Summary
CVE-2026-73844: CKAN MCP Server: Information disclosure via verbose error reflection. Affects @aborruso/ckan-mcp-server versions < 0.4.112. Fixed in 0.4.112. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The @aborruso/ckan-mcp-server package is a server implementation for the CKAN (Comprehensive Knowledge Archive Network) that facilitates the management and sharing of data. It is designed to provide a robust API for interacting with CKAN datasets. However, it has a vulnerability that allows sensitive information to be disclosed through error messages, potentially exposing internal system details.
Vulnerability Detail
The vulnerability arises from the server's error handling mechanism, which reflects raw upstream response bodies and internal exception messages back to the caller. This can occur when the server encounters a non-CKAN response or an internal exception. As a result, attackers can gain access to sensitive information such as internal IP addresses, database errors, and stack traces, which can aid in reconnaissance and exploitation of the system. The severity of this vulnerability is rated as low, but it can significantly amplify the impact of Server-Side Request Forgery (SSRF) attacks by providing a channel for response content.
How To Fix
Minimum fixed version
0.4.112
This is the first release that contains the fix.
npm install @aborruso/ckan-mcp-server@0.4.112Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can modify the error handling in the server code to prevent detailed error messages from being sent to the client. For example, in the catch-all handler, replace the raw error message with a generic message or a correlation ID. Here is a code snippet to illustrate this change:
return new Response(JSON.stringify({
jsonrpc: '2.0',
error: { code: -32603, message: 'Internal error', data: 'An error occurred, please try again later.' },
id: null
}), { status: 500, ... });
Conclusion
The CVE-2026-73844 vulnerability in the @aborruso/ckan-mcp-server package poses a risk of information disclosure through verbose error messages. It is crucial to update to the patched version to mitigate this risk and implement the recommended workarounds in the meantime.
See every vulnerability recorded for @aborruso/ckan-mcp-server →
FAQ
CVE-2026-73844 is a vulnerability in the @aborruso/ckan-mcp-server package that allows information disclosure through verbose error reflection.
This vulnerability can expose sensitive internal information, which may aid attackers in exploiting your application or infrastructure.
Implement the suggested workaround to prevent detailed error messages from being sent to clients until you can update the package.
You can use tools like Vulert, which monitors your package-lock.json file for open-source vulnerabilities in real-time without requiring code access.
The CVSS score for this vulnerability is 3.7, indicating a low severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for @aborruso/ckan-mcp-server.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
