CVE-2026-53509: CKAN MCP Server SSRF Vulnerability

CVE-2026-53509 Overview

CVE-2026-53509 is a Server-Side Request Forgery (SSRF) filter bypass affecting the CKAN MCP Server, a tool used to query CKAN open data portals through the Model Context Protocol. The vulnerability resides in src/utils/http.ts, which validates caller-supplied CKAN URLs by inspecting only the parsed hostname. Hostname aliases such as ip6-localhost bypass the loopback check because they are neither equal to localhost nor dotted IPv4 or bracketed IPv6 literals. A remote MCP caller supplying a crafted server_url can force the server to connect to loopback or private addresses and receive CKAN-shaped response data. The issue is fixed in version 0.4.106.

Critical Impact
Authenticated MCP callers can pivot the server into internal networks and exfiltrate data from loopback and private services reachable by the host [CWE-918].

Affected Products

CKAN MCP Server versions prior to 0.4.106
Deployments exposing ckan_package_search tool with caller-controlled base_url
Deployments exposing sparql_query tool with caller-controlled base_url

Discovery Timeline

2026-08-21 - CVE-2026-53509 published to NVD
2026-08-21 - Last updated in NVD database

Technical Details for CVE-2026-53509

Vulnerability Analysis

CKAN MCP Server exposes tools that accept a caller-supplied base_url or server_url and issues outbound HTTP requests to the target. A prior fix for CVE-2026-33060 introduced hostname filtering to prevent SSRF against internal addresses. That filter compared the parsed hostname against the literal string localhost and rejected dotted IPv4 and bracketed IPv6 literals belonging to reserved ranges.

The filter did not account for other DNS names that resolve to loopback. Standard Linux /etc/hosts files map aliases like ip6-localhost and ip6-loopback to ::1. These strings pass the hostname allowlist as arbitrary DNS names, but the underlying HTTP client resolves them to loopback at request time. The result is a canonical SSRF filter bypass that reaches services bound to 127.0.0.1 and ::1.

Root Cause

The root cause is validation based on string comparison of the parsed hostname rather than resolved IP addresses. The check hostname === 'localhost' treats loopback as a single canonical name. It ignores that name resolution occurs later in the request pipeline and that multiple aliases map to reserved addresses. This is a classic parse-versus-resolve mismatch categorized under [CWE-918].

Attack Vector

A remote caller with permission to invoke CKAN tools submits a server_url whose hostname is an alias such as ip6-localhost. The server's URL validator accepts the hostname because it does not match the blocked string set. The HTTP client then resolves the alias to ::1 and issues the request against a service listening on the loopback interface. When the target responds with CKAN-shaped JSON, the server returns response-derived content to the caller. Attackers can enumerate internal services, read metadata endpoints on cloud platforms, or trigger state-changing requests on internal APIs.

The patched code in version 0.4.106 replaces the single string comparison with a blocked-hostname Set covering localhost, ip6-localhost, and ip6-loopback. See the GitHub Security Advisory GHSA-g84h-j7jj-x32p for details.

Detection Methods for CVE-2026-53509

Indicators of Compromise

Outbound HTTP requests from the CKAN MCP Server process targeting loopback addresses 127.0.0.1 or ::1
Tool invocation logs containing server_url or base_url values with hostnames ip6-localhost, ip6-loopback, or unexpected DNS aliases
Connections from the MCP server to RFC1918 addresses or cloud metadata endpoints such as 169.254.169.254

Detection Strategies

Instrument the MCP server to log the resolved IP address for every outbound request and alert when resolution yields loopback, link-local, or private ranges
Inspect application logs for CKAN tool calls whose base_url hostname does not appear on an approved list of public CKAN portals
Correlate MCP tool invocations with network flow data to surface unexpected internal destinations

Monitoring Recommendations

Deploy egress filtering on the host running the MCP server and alert on blocked internal destinations
Track version metadata for the ckan-mcp-server package across deployments and flag hosts running versions earlier than 0.4.106
Review authentication logs to correlate MCP caller identities with anomalous URL parameters

How to Mitigate CVE-2026-53509

Immediate Actions Required

Upgrade CKAN MCP Server to version 0.4.106 or later on all deployments
Restrict which authenticated principals can invoke CKAN tools that accept a caller-controlled server_url
Enforce network-level egress restrictions so the MCP server cannot reach loopback or RFC1918 addresses it does not require

Patch Information

The fix is delivered in GitHub Release v0.4.106. The patch replaces the single hostname === 'localhost' check in src/utils/http.ts with a blocked-hostname Set that includes ip6-localhost and ip6-loopback. Refer to GitHub Security Advisory GHSA-3xm7-qw7j-qc8v for the coordinated advisory.

Workarounds

Place the MCP server behind an outbound HTTP proxy that enforces an allowlist of approved CKAN portal hostnames
Disable tools that accept caller-supplied URLs when the upgrade cannot be applied immediately
Configure host firewall rules to block outbound traffic from the MCP server process to 127.0.0.0/8, ::1, and 169.254.169.254

bash

# Configuration example: upgrade to the patched release
npm install ckan-mcp-server@0.4.106

# Host-level egress restriction for the MCP server process (Linux, iptables owner match)
iptables -A OUTPUT -m owner --uid-owner ckan-mcp -d 127.0.0.0/8 -j REJECT
ip6tables -A OUTPUT -m owner --uid-owner ckan-mcp -d ::1/128 -j REJECT
iptables -A OUTPUT -m owner --uid-owner ckan-mcp -d 169.254.169.254 -j REJECT