Summary
CKAN MCP Server: Cache-key canonicalization collision enables cache confusion / poisoning
The response cache derives its key from an ambiguous string serialization of the request parameters. canonicalizeParams joins sorted ${key}=${value} pairs with & and does not escape &, =, or the | field separators used in buildCacheKey. Two different logical parameter sets can therefore serialize to the same key and share one cache entry. Because the cached value is whatever the upstream returned for whichever request populated the entry first, an attacker can prime a colliding key so a victim's distinct query (same server_url) is served the attacker's cached response.
Affected code
// src/utils/cache.ts
export function canonicalizeParams(params) {
const keys = Object.keys(params).sort();
const pairs = [];
for (const key of keys) {
const value = params[key];
if (value === undefined || value === null) continue;
const serialized = typeof value === "object" ? JSON.stringify(value) : String(value);
pairs.push(`${key}=${serialized}`); // value not escaped
}
return pairs.join("&"); // '&' delimiter, injectable
}
export async function buildCacheKey(serverUrl, action, params) {
const raw = `${serverUrl}|${action}|${canonicalizeParams(params)}`; // '|' also unescaped
return sha1Hex(raw);
}
Confirmed collisions (identical key):
{ q: "budget", rows: 10 }≡{ q: "budget&rows=10" }→ both canonicalize toq=budget&rows=10{ filters: { a: "b" } }≡{ filters: '{"a":"b"}' }→ both canonicalize tofilters={"a":"b"}(object-vs-string ambiguity)
An attacker can reproduce any target canonical string by injecting it into the alphabetically-first parameter, so the collision is general, not incidental.
Proof of concept
poc/cache-collision-poc.mjs primes a single-param request and shows a victim's
distinct two-param request being served the attacker-primed entry:
attacker canonical : q=budget&rows=10
victim canonical : q=budget&rows=10
same cache key : true
victim served from cache: true
victim RECEIVED : RESULT_FOR({"q":"budget&rows=10"})
victim EXPECTED : RESULT_FOR({"q":"budget","rows":10})
Impact
- Cache poisoning / confusion. On a shared cache (caching is enabled by
default; the Cloudflare Workers deployment uses the sharedcaches.default, and
a Node HTTP instance shares one in-process LRU across all clients), an attacker
primes a colliding entry so that another client's genuinely different query
receives the attacker-chosen response for the same portal. - Integrity of results. Victims receive data for a query they did not make
(wrong dataset list, wrong record set), undermining trust in tool output. - Chains with indirect prompt injection (advisory #07). The attacker's
colliding request can be one whose upstream response surfaces an
attacker-controlled dataset (with maliciousnotes/title); the victim's
benign query then serves that poisoned content to the model, delivering prompt
injection via the cache, without the victim ever querying the malicious dataset.
Confidentiality impact is low (same-portal public data); the primary damage is
integrity. AC:H reflects the need for caching to be enabled and a shared
instance plus priming before the victim's request populates the entry.
CVE-2026-73846 has a CVSS score of 6.5 (Medium). The vector is network-reachable, no privileges required, and no user interaction. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (0.4.112); upgrading removes the vulnerable code path.
Affected versions
Security releases
Kodem intelligence
Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.
Already deployed Kodem?
See it in your environmentNew to Kodem? Get a demo →Remediation advice
- Build the cache key from an unambiguous, injection-proof encoding: hash a
structured, canonical JSON (with typed values) or percent-encode/escape each key
and value before joining, and use a separator that cannot appear in the encoded
fields. Include a type tag so{a:{...}}(object) and{a:"..."}(string)
never coincide. - Consider partitioning the cache per client/tenant on shared deployments so one
client cannot influence another's entries.
Frequently Asked Questions
- What is CVE-2026-73846? CVE-2026-73846 is a medium-severity security vulnerability in @aborruso/ckan-mcp-server (npm), affecting versions < 0.4.112. It is fixed in 0.4.112.
- How severe is CVE-2026-73846? CVE-2026-73846 has a CVSS score of 6.5 (Medium). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
- Which versions of @aborruso/ckan-mcp-server are affected by CVE-2026-73846? @aborruso/ckan-mcp-server (npm) versions < 0.4.112 is affected.
- Is there a fix for CVE-2026-73846? Yes. CVE-2026-73846 is fixed in 0.4.112. Upgrade to this version or later.
- Is CVE-2026-73846 exploitable, and should I be worried? Whether CVE-2026-73846 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
- What actually determines whether CVE-2026-73846 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
- How do I fix CVE-2026-73846? Upgrade
@aborruso/ckan-mcp-serverto 0.4.112 or later.