CVE-2026-73846: CVE-2026-73846: Cache Key Canonicalization Collision in ondata ckan-mcp-server

#security #cve #cybersecurity

CVE-2026-73846: Cache Key Canonicalization Collision in ondata ckan-mcp-server

Vulnerability ID: CVE-2026-73846
CVSS Score: 6.5
Published: 2026-09-03

A medium-severity cache key canonicalization collision vulnerability exists in the ckan-mcp-server prior to version 0.4.112. Unescaped delimiters in key-value parameters and server URLs allow structurally distinct requests to map to the same cryptographic hash, facilitating cache poisoning and unauthorized data exposure.

TL;DR

Unescaped delimiters in ckan-mcp-server's caching logic allow attackers to cause cache collisions, leading to cache poisoning and unauthorized data exposure.

Technical Details

CWE ID: CWE-345 / CWE-436
Attack Vector: Network
CVSS Score: 6.5 (Medium)
EPSS Score: 0.00137 (Percentile: 3.39%)
Impact: Cache Poisoning / Integrity Compromise
Exploit Status: None (No Public PoC)
KEV Status: Not Listed

Affected Systems

ondata ckan-mcp-server
ckan-mcp-server: < 0.4.112 (Fixed in: 0.4.112)

Code Analysis

Commit: 8e1522f

Remove string concatenation and implement type-safe JSON serialization for cache keys.

Commit: 3b827af

Tag release and adjust cache logic.

Mitigation Strategies

Upgrade ckan-mcp-server to version 0.4.112 or higher.
Implement strict input validation on query parameters to reject unescaped delimiters.
Disable cache entirely if data consistency is critical and performance permits.

Remediation Steps:

Identify all deployments running ondata/ckan-mcp-server.
Check the package version in package.json to verify if it is below 0.4.112.
Update the package dependency to version 0.4.112 or higher using npm, yarn, or pnpm.
Deploy the updated application and restart the MCP server to clear any legacy poisoned cache entries.

References

Read the full report for CVE-2026-73846 on our website for more details including interactive diagrams and full exploit analysis.

DEV Community