CVE-2026-73846: Cache-key Canonicalization Collision in @aborruso/ckan-mcp-server Leads to Cache Poisoning
Summary
CVE-2026-73846: CKAN MCP Server: Cache-key canonicalization collision enables cache confusion / poisoning. Affects @aborruso/ckan-mcp-server versions < 0.4.112. Fixed in 0.4.112. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The @aborruso/ckan-mcp-server is an open-source server designed to facilitate interactions with CKAN (Comprehensive Knowledge Archive Network) data portals. It allows users to query and retrieve datasets efficiently. However, due to its reliance on caching mechanisms for performance optimization, it is susceptible to vulnerabilities that can compromise data integrity and trust.
Vulnerability Detail
The vulnerability arises from the way the server constructs cache keys from request parameters. The function 'canonicalizeParams' does not properly escape certain characters, leading to ambiguous string serialization. This allows two different sets of parameters to generate the same cache key, resulting in cache confusion or poisoning. An attacker can exploit this by priming a cache entry with malicious data, which can then be served to unsuspecting users making legitimate requests. This undermines the integrity of the data served, as victims may receive incorrect or harmful responses.
How To Fix
Minimum fixed version
0.4.112
This is the first release that contains the fix.
npm install @aborruso/ckan-mcp-server@0.4.112Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider partitioning the cache per client or tenant in shared deployments. This can prevent one client's requests from influencing another's cache entries. However, this does not fully resolve the underlying issue and should only be used until the package is updated.
Conclusion
The CVE-2026-73846 vulnerability in the @aborruso/ckan-mcp-server package poses a significant risk of cache poisoning due to improper cache key construction. It is crucial to update to the patched version to ensure data integrity and trust in the application. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for @aborruso/ckan-mcp-server →
FAQ
The primary impact is cache poisoning, where an attacker can manipulate the cache to serve incorrect data to users, undermining the integrity of the application.
You can use Vulert, which monitors open-source vulnerabilities in real-time. By checking your package-lock.json file, you can determine if your application is affected by this vulnerability.
The CVSS score for this vulnerability is 6.5, indicating a moderate severity level.
Yes, a proof of concept demonstrates how an attacker can prime a cache entry and serve it to a victim, showing the potential impact of the vulnerability.
If an immediate update is not possible, implement the suggested workaround of partitioning the cache to mitigate the risk until the package can be updated.
References
Related vulnerabilities
Recent vulnerabilities recorded for @aborruso/ckan-mcp-server.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
