CKAN MCP Server SSRF via Weak Host Validation Regex (CVE-2026-73845)

Technical Analysis

The ckan_get_mqa_quality and ckan_get_mqa_quality_details tools call isValidMqaServer to whitelist server_url values, but the regex only checks that the string starts with (or contains as a prefix) the expected domain rather than properly parsing the URL's host component. An attacker-supplied value such as 'dati.gov.it.attacker.com' or 'https://dati.gov.it@attacker.com/' passes the flawed check while the actual HTTP request resolves to the attacker's infrastructure. The MCP server then returns the attacker-controlled response content as if it were authoritative CKAN MQA data, allowing injection of falsified quality metrics or, depending on downstream consumption, secondary prompt injection into the LLM agent processing the tool result. This crosses the tool/agent boundary because the agent's reasoning and any decisions it makes trust the tool output as coming from a verified government data source.

Affected Systems

CKAN MCP Server; protocols: MCP

Detection Signatures

• server_url parameter values containing dati.gov.it as substring but not matching exact host (e.g., dati.gov.it.<attacker-domain>)
• URLs with userinfo component before dati.gov.it (e.g., https://dati.gov.it@<attacker-domain>)
• Outbound HTTP requests from MCP server host to domains other than the official dati.gov.it endpoint
• Unexpected or malformed MQA quality response payloads returned to the agent
• Logs showing isValidMqaServer or equivalent validator passing on non-canonical hostnames

Remediation Steps

1. 1

   Upgrade CKAN MCP Server

   Update to version 0.4.112 or later, which fixes the host validation logic.

2. 2

   Use proper URL parsing for host validation

   Replace prefix/substring regex checks with strict URL parsing (e.g., using the URL API) that extracts and exact-matches the hostname against an allowlist, rejecting userinfo and subdomain-suffix tricks.

3. 3

   Enforce allowlisting at network layer

   Restrict outbound requests from the MCP server to a fixed set of approved hosts via egress filtering, independent of application-layer validation.

4. 4

   Treat tool output as untrusted

   Have the consuming agent validate and sanity-check data quality responses before acting on them, and avoid feeding raw tool output directly into further automated decisions without provenance checks.