{"vulnerability": "cve-2026-73846", "sightings": [{"uuid": "5c63bd5d-c597-4e27-9fe7-b386c402c09d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-73846", "type": "published-proof-of-concept", "source": "https://github.com/ondata/ckan-mcp-server/security/advisories/GHSA-78x9-fhhx-v2g6", "content": "", "creation_timestamp": "2026-09-03T16:35:02.793379Z"}, {"uuid": "fb4c9284-1468-44ec-b220-36de13914173", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-73846", "type": "seen", "source": "https://gist.github.com/alon710/6e5cd16daf1e1da3bc33cf6d0ea63990", "content": "# CVE-2026-73846: CVE-2026-73846: Cache Key Canonicalization Collision in ondata ckan-mcp-server\n\n> **CVSS Score:** 6.5\n> **Published:** 2026-09-03\n> **Full Report:** https://cvereports.com/reports/CVE-2026-73846\n\n## Summary\nA medium-severity cache key canonicalization collision vulnerability exists in the ckan-mcp-server prior to version 0.4.112. Unescaped delimiters in key-value parameters and server URLs allow structurally distinct requests to map to the same cryptographic hash, facilitating cache poisoning and unauthorized data exposure.\n\n## TL;DR\nUnescaped delimiters in ckan-mcp-server's caching logic allow attackers to cause cache collisions, leading to cache poisoning and unauthorized data exposure.\n\n## Technical Details\n\n- **CWE ID**: CWE-345 / CWE-436\n- **Attack Vector**: Network\n- **CVSS Score**: 6.5 (Medium)\n- **EPSS Score**: 0.00137 (Percentile: 3.39%)\n- **Impact**: Cache Poisoning / Integrity Compromise\n- **Exploit Status**: None (No Public PoC)\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- ondata ckan-mcp-server\n- **ckan-mcp-server**: < 0.4.112 (Fixed in: `0.4.112`)\n\n## Mitigation\n\n- Upgrade ckan-mcp-server to version 0.4.112 or higher.\n- Implement strict input validation on query parameters to reject unescaped delimiters.\n- Disable cache entirely if data consistency is critical and performance permits.\n\n**Remediation Steps:**\n1. Identify all deployments running ondata/ckan-mcp-server.\n2. Check the package version in package.json to verify if it is below 0.4.112.\n3. Update the package dependency to version 0.4.112 or higher using npm, yarn, or pnpm.\n4. Deploy the updated application and restart the MCP server to clear any legacy poisoned cache entries.\n\n## References\n\n- [GitHub Security Advisory GHSA-78x9-fhhx-v2g6](https://github.com/ondata/ckan-mcp-server/security/advisories/GHSA-78x9-fhhx-v2g6)\n- [Official Fix Commit](https://github.com/ondata/ckan-mcp-server/commit/8e1522f9bbfa1f3b21550f17887f60f133e24151)\n- [Release v0.4.112](https://github.com/ondata/ckan-mcp-server/releases/tag/v0.4.112)\n- [NVD - CVE-2026-73846](https://nvd.nist.gov/vuln/detail/CVE-2026-73846)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-73846) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-03T17:31:38.235049Z"}]}