CVE-2026-33060: 
JavaScript vulnerability analysis and mitigation

CVE-2026-33060 is a Server-Side Request Forgery (SSRF) vulnerability in the CKAN MCP Server (@aborruso/ckan-mcp-server), an npm package for querying CKAN open data portals via AI assistants. The vulnerability affects all versions prior to 0.4.85 and was discovered by Andrei Boldyrev of Munio Security Research. It was published on March 16, 2026, and added to the GitHub Advisory Database on March 18, 2026. The CVSS v3.1 base score is 5.7 (Moderate) per the GitHub Advisory Database (GitHub Advisory, CKAN MCP Advisory).

The root cause is a complete absence of URL validation on the base_url parameter accepted by multiple MCP tools: ckan_package_search, sparql_query, and ckan_datastore_search_sql (CWE-918: Server-Side Request Forgery). There is no blocking of private IP ranges (RFC 1918), link-local addresses (169.254.x.x), or cloud metadata endpoints, allowing the server to make HTTP requests to arbitrary internal or external endpoints. Exploitation requires an attacker to perform prompt injection — embedding malicious instructions in content (e.g., a webpage or document) processed by a victim's AI assistant that has this MCP server connected — to control the base_url parameter. A proof-of-concept JSON payload {"tool": "ckan_package_search", "arguments": {"base_url": "http://canary:8080/ssrf", "query": "test"}} was confirmed to trigger 9 HTTP requests to an arbitrary internal endpoint, demonstrating the lack of rate limiting or validation (GitHub Advisory, CKAN MCP Advisory).

Successful exploitation enables internal network scanning, cloud metadata theft (including IAM credentials via the Instance Metadata Service at 169.254.169.254), and potential SQL/SPARQL injection through unsanitized query parameters passed to ckan_datastore_search_sql and sparql_query. The primary impact is high confidentiality loss — an attacker can exfiltrate sensitive cloud credentials that could enable lateral movement to other cloud resources or services. Integrity and availability are not directly impacted by the SSRF itself, though secondary injection attacks could affect data integrity (GitHub Advisory, CKAN MCP Advisory).

A proof-of-concept exploit is publicly available in the security advisory, consisting of a concrete JSON payload that was tested and confirmed to trigger SSRF in an isolated Docker environment (CKAN MCP Advisory). There is no evidence of in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is approximately 0.028% (4th percentile), indicating a low current probability of exploitation. Exploitation requires a low-privileged authenticated user and user interaction (prompt injection via malicious content), which raises the practical attack complexity (GitHub Advisory).

1. Reconnaissance: Identify AI assistant deployments (e.g., Claude, GPT-based agents) that have the @aborruso/ckan-mcp-server MCP server connected and are running a version prior to 0.4.85.
2. Craft prompt injection payload: Create malicious content (e.g., a webpage, document, or dataset description) that contains embedded instructions directing the AI assistant to invoke the ckan_package_search, sparql_query, or ckan_datastore_search_sql tool with an attacker-controlled base_url.
3. Deliver the payload: Cause the victim's AI assistant to process the malicious content — for example, by having the assistant browse a URL, summarize a document, or query a CKAN portal containing the injected instructions.
4. Trigger SSRF: The AI assistant, following the injected instructions, calls the MCP tool with a payload such as {"tool": "ckan_package_search", "arguments": {"base_url": "http://169.254.169.254/latest/meta-data/", "query": "test"}}, causing the server to make HTTP requests to the cloud metadata endpoint.
5. Exfiltrate credentials: Retrieve IAM credentials or other sensitive metadata returned from the IMDS endpoint via the MCP tool's response, which is relayed back through the AI assistant (GitHub Advisory, CKAN MCP Advisory).

• Network: Outbound HTTP requests from the CKAN MCP Server process to 169.254.169.254 (AWS/Azure/GCP IMDS) or other RFC 1918 private IP ranges (10.x.x.x, 172.16-31.x.x, 192.168.x.x); multiple rapid HTTP requests to unexpected internal endpoints.
• Logs: MCP server logs showing base_url parameter values set to internal IPs, link-local addresses, or cloud metadata URLs rather than legitimate CKAN portal domains; high-frequency repeated requests (e.g., 9+ requests per tool invocation) to non-CKAN endpoints.
• Process: Unusual outbound connections initiated by the Node.js process running the MCP server to internal network hosts or metadata services not associated with any configured CKAN portal (GitHub Advisory).

Upgrade @aborruso/ckan-mcp-server to version 0.4.85 or later, which addresses the SSRF vulnerability (GitHub Advisory). As a network-level workaround, implement egress filtering to block the MCP server process from accessing RFC 1918 private IP ranges, link-local addresses (169.254.x.x), and cloud metadata endpoints. Additionally, consider restricting the MCP server's network access to only known CKAN portal domains via firewall rules or a proxy allowlist. The advisory recommends validating base_url against a configurable allowlist of permitted CKAN portals and sanitizing SQL/SPARQL query inputs (CKAN MCP Advisory).

The vulnerability was credited to Andrei Boldyrev of Munio Security Research, who discovered it using the Munio security tool (GitHub Advisory). The advisory was referenced in an OWASP AISVS pull request, suggesting it is being used as a real-world example in AI security standards discussions (OWASP AISVS PR). No significant broader media coverage or notable social media reactions beyond standard vulnerability tracking feeds have been identified.