CVE-2026-61612: CKAN MCP Server SSRF Vulnerability

CVE-2026-61612 Overview

CKAN MCP Server, a tool for querying CKAN open data portals, contains a Server-Side Request Forgery (SSRF) vulnerability in versions prior to 0.4.108. The validateServerUrl guard added for CVE-2026-33060 and extended for CVE-2026-53509 validates only the hostname string and never resolves DNS. An attacker-supplied server_url whose hostname resolves to an internal address bypasses the guard. The server then issues requests to loopback and cloud metadata endpoints such as 169.254.169.254. This represents the third bypass of the same guard and, unlike prior variants, reaches the Instance Metadata Service (IMDS). Version 0.4.108 contains the corrected fix. [CWE-918]

Critical Impact
Attackers can force the server to fetch cloud metadata credentials from IMDS, enabling potential compromise of the underlying cloud instance identity.

Affected Products

CKAN MCP Server versions prior to 0.4.108
Deployments exposing the server_url parameter to untrusted callers
Cloud-hosted instances with accessible IMDS endpoints (AWS, Azure, GCP)

Discovery Timeline

2026-09-21 - CVE CVE-2026-61612 published to NVD
2026-09-24 - Last updated in NVD database

Technical Details for CVE-2026-61612

Vulnerability Analysis

The vulnerability is a classic DNS-rebinding-style SSRF bypass. The validateServerUrl function inspects only the textual hostname component of the caller-supplied server_url. It does not resolve the hostname to an IP address before deciding whether the target is safe. Any attacker-controlled domain that resolves to a private, loopback, or link-local address passes validation.

Once validation succeeds, the CKAN MCP Server issues an outbound HTTP request to the resolved address. This allows access to internal services on loopback and, more critically, to the cloud Instance Metadata Service at 169.254.169.254. On unprotected cloud instances, IMDS returns temporary credentials associated with the instance role.

This is the third variant of the same guard weakness, following CVE-2026-33060 and CVE-2026-53509. The prior variant reached only loopback, while this bypass reaches IMDS.

Root Cause

The guard performs string-based hostname matching against a denylist rather than resolving the hostname and evaluating the actual destination IP. Because DNS resolution occurs later inside the HTTP client, the effective destination is never checked against the allowlist.

Attack Vector

An authenticated caller supplies a server_url whose hostname resolves to 127.0.0.1, 169.254.169.254, or an RFC1918 range. The server accepts the URL and issues the request server-side, returning response contents to the caller.

text

// Patch metadata from manifest.json
 {
   "dxt_version": "0.1",
   "name": "ckan-mcp-server",
-  "version": "0.4.107",
+  "version": "0.4.108",
   "display_name": "CKAN MCP Server",
   ...
 }
// Source: https://github.com/ondata/ckan-mcp-server/commit/bb7439b553b9f965adc3d43bcd415c42eebe2f40

typescript

// src/server.ts version bump accompanying the SSRF fix
 export function createServer(): McpServer {
   return new McpServer({
     name: "ckan-mcp-server",
-    version: "0.4.107"
+    version: "0.4.108"
   });
 }
// Source: https://github.com/ondata/ckan-mcp-server/commit/bb7439b553b9f965adc3d43bcd415c42eebe2f40

The patch commit message describes the fix as: fix(security): resolve DNS to close SSRF bypass + mandatory HTTP allowlist.

Detection Methods for CVE-2026-61612

Indicators of Compromise

Outbound HTTP requests from the CKAN MCP Server process to 169.254.169.254 or fd00:ec2::254.
Requests to loopback addresses (127.0.0.0/8) or RFC1918 ranges originating from the server process.
Unexpected DNS lookups for attacker-controlled domains that resolve to internal or link-local addresses.

Detection Strategies

Inspect server access logs and outbound proxy logs for server_url values pointing to non-public hosts.
Correlate MCP invocation events with subsequent egress to metadata service IPs.
Alert on any process attempting to retrieve IAM credentials from IMDS without expected justification.

Monitoring Recommendations

Enforce IMDSv2 on AWS instances and monitor PutMetadataToken request patterns for anomalies.
Ship CKAN MCP Server logs and egress telemetry to a centralized analytics platform for correlation.
Baseline outbound destinations for the service and flag first-seen internal or link-local targets.

How to Mitigate CVE-2026-61612

Immediate Actions Required

Upgrade CKAN MCP Server to version 0.4.108 or later.
Enforce IMDSv2 on all cloud instances hosting the server to require session tokens for metadata access.
Restrict egress from the CKAN MCP Server host to only the domains required for CKAN portal access.

Patch Information

The fix is delivered in GitHub Release v0.4.108 via commit bb7439b. The patch resolves DNS before validation and enforces a mandatory HTTP allowlist. See the GitHub Security Advisory GHSA-798p-78g2-v556 for full disclosure details.

Workarounds

Place the CKAN MCP Server behind an egress proxy that blocks traffic to 169.254.169.254, loopback, and RFC1918 destinations.
Run the service in a network namespace or container without route access to the metadata service.
Restrict callers who can supply arbitrary server_url values to trusted operators only.

bash

# Block metadata service egress with iptables as a defense-in-depth control
iptables -A OUTPUT -m owner --uid-owner ckan-mcp -d 169.254.169.254 -j REJECT
iptables -A OUTPUT -m owner --uid-owner ckan-mcp -d 127.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner ckan-mcp -d 10.0.0.0/8 -j REJECT