CVE-2026-73846 CKAN MCP Server: Cache-key canonicalization collision enables cache confusion / poisoning
An attacker can poison the shared cache by exploiting parameter serialization flaws, causing victims to receive incorrect or malicious data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-73846?
CVE-2026-73846 is a medium-severity vulnerability in ondata ckan-mcp-server, published on 14 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
CKAN MCP Server is a tool for querying CKAN open data portals. Prior to 0.4.112, canonicalizeParams in src/utils/cache.ts serializes request parameters with unescaped ampersand, equals-sign, and vertical-bar delimiters, allowing different logical parameter sets used by buildCacheKey to collide and an attacker to prime a shared cache with a response for a victim's distinct query. This issue is fixed in version 0.4.112.
Which versions are affected by CVE-2026-73846?
2 open source packages ship an affected version, including @aborruso/ckan-mcp-server.
| Package | Affected | Fixed in |
|---|---|---|
@aborruso/ckan-mcp-server npm | All versions | 0.4.112 |
@aborruso/ckan-mcp-server npm | All versions | 0.4.112 |
How do I fix CVE-2026-73846?
Upgrade @aborruso/ckan-mcp-server to 0.4.112 or later.
Is CVE-2026-73846 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-73846 exists.
Sources
Also known as GHSA-78x9-fhhx-v2g6.