What is CVE-2026-73845?
CVE-2026-73845 involves improper validation of the server_url parameter in CKAN MCP Server's quality tools via a prefix-only regex for `dati.gov.it`, enabling suffix manipulation. This can lead to server-side request forgery (SSRF) in versions prior to 0.4.112; updating is advised.
Azərbaycanca: CVE-2026-73845 CKAN MCP Server-də server_url parametrinin yalnış validasiyası ilə bağlıdır. `dati.gov.it` üçün prefix-only regex istifadə edildiyindən, hücumçular suffix manipulyasiyası ilə server URL-ni dəyişərək server-side request forgery (SSRF) həyata keçirə bilər. 0.4.112 versiyasından əvvəlki versiyalar təsirlənir, dərhal yeniləmək tövsiyə olunur.
Related CVEs
link basis: same weakness class CWE-918
FAQ2
Which parameter's improper validation leads to CVE-2026-73845 in CKAN MCP Server?
The vulnerability arises from improper validation of the server_url parameter. Because a prefix-only regex for `dati.gov.it` is used for server_url, attackers can perform suffix manipulation.
Which versions of CKAN MCP Server are affected by the CVE-2026-73845 SSRF vulnerability?
All versions prior to 0.4.112 are affected by this SSRF vulnerability. Users are advised to update immediately.
See also6
This explainer is AI-written from source data — skopnix's own reporting on this CVE; CVSS scores, vendors and versions are never invented. See NVD for the official record.