CKAN MCP Server Cache Key Collision (Cache Poisoning via Delimiter Injection)
First seen Aug 15, 2026 · Updated Aug 15, 2026 · CVSS 6.5
The CKAN MCP Server had a flaw where request parameters were serialized into cache keys using unescaped delimiter characters (&, =, |), allowing different logical queries to produce identical cache keys. An attacker could exploit this collision to poison the shared cache with attacker-controlled data that gets served back to a victim making a distinct, legitimate query.
Technical Analysis
The vulnerability lies in canonicalizeParams within src/utils/cache.ts, which concatenates parameter names/values using ampersand, equals-sign, and vertical-bar characters without escaping them. Because these characters can also appear within parameter values themselves, two semantically different parameter sets can serialize to the same string and thus the same cache key via buildCacheKey. An attacker who can submit crafted queries to the shared MCP server cache can engineer a collision so that their attacker-controlled response is cached under a key later reused by a victim's distinct query, resulting in cross-user response confusion (cache poisoning) rather than direct code execution. This crosses a trust boundary because the MCP server mediates access to a shared CKAN data source on behalf of multiple agent sessions/users, so a cache-layer bug becomes a cross-session/cross-agent data integrity issue.
Affected Systems
CKAN MCP Server; protocols: MCP
Detection Signatures
- Cache keys derived from raw concatenation of parameter names/values containing &, =, or | without escaping
- Repeated or anomalous cache hits returning data inconsistent with the requesting agent's query parameters
- Requests containing embedded delimiter characters (&, =, |) within parameter values
- Unexpected cross-session data reuse in MCP tool responses for CKAN queries
Remediation Steps
- 1
Upgrade CKAN MCP Server
Update to version 0.4.112 or later, which fixes canonicalizeParams to properly escape or encode delimiter characters before serialization.
- 2
Use structured serialization for cache keys
Replace manual string concatenation with a canonical, collision-resistant encoding such as JSON.stringify with sorted keys or URL-encoding of all parameter values before hashing.
- 3
Segment cache by identity/session
Partition cache entries by requesting user/agent/session identifier in addition to query parameters to limit blast radius of any residual collision.
- 4
Add cache integrity validation
Implement monitoring/alerting for cache entries whose stored parameters do not exactly match the canonical form of incoming requests.
CVE / Advisory IDs
Industries Most Exposed
Respond to this threat
Pro subscribers get a full AI-generated incident-response playbook for this threat — detection, containment, eradication, and recovery steps — plus an unlimited AI Threat Advisor for questions about your environment.