ZDF
Sign inSign up

Vulnerabilities

Vulnerability · CVE-2026-76894

ckan-mcp-server: DataStore Table UI resource does not validate postMessage origin (in) and posts to targetOrigin "*" (out)

Published Oct 16, 2026 · catalog updated Oct 16, 2026 · ckan-mcp-server: DataStore Table UI

Open the advisory

Exploitation likelihood is not on this record for CVE-2026-76894. A missing EPSS score is not a low risk. Compare ckan-mcp-server: DataStore Table UI with the linked advisory before you change production.

Gaps on this record

  • The stored product name is a package slug. The name on this page is taken from the title (ckan-mcp-server: DataStore Table UI).
  • No vendor fix or required action is stored. Compare the linked advisory before you change production.
  • EPSS is missing. A missing score is not a low risk.
Severity
Low3.1
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
Not in the current FIRST EPSS dataset
Remediation
Version ranges on file
Affected products
npm @aborruso · npm @aborruso/ckan-mcp-server

## Summary The MCP Apps UI resource (an interactive DataStore table rendered in the host's webview/iframe) communicates with its parent via . Its inbound listener performs no validation, and its outbound messages are sent with target origin . Any window/frame able to reach the document can inject data into the table and interfere with the MCP UI handshake, and the UI's own JSON-RPC messages are broadcast without an origin restriction. ## Affected code (inline HTML): There is no allowlist of accepted origins for inbound messages and no fixed target origin for outbound messages. ## Impact - **Content spoofing.** A frame that can to the UI can supply arbitrary / , causing the table to render fabricated rows and links (e.g. a phishing ) that appear to come from the queried portal. (Values are HTML-escaped, so this is display spoofing, not script injection — no XSS.) - **Handshake/UX interference.** Because inbound messages matching a pending resolve/reject the UI's MCP requests, an attacker frame can spoof responses to the handshake or otherwise disrupt the panel. - **Outbound leakage.** Posting to means the UI's JSON-RPC messages are delivered to whatever the parent origin is; if the resource is ever embedded by a context other than the trusted host, those messages leak to it. Exploitability depends on the host embedding model (in a correct MCP Apps host the parent is the trusted host, which limits who can message the frame), so this is a hardening / defense-in-depth issue rather than a directly remotely-triggerable one — hence Low. ## Proof of concept - — static confirmation that the listener has no origin check and outbound uses : - — a page that embeds the UI and injects fabricated rows cross-origin with no handshake; the UI renders them. ## Remediation - Validate against the expected host origin on every inbound message; drop messages from other origins. - Send outbound with an explicit target origin (the host origin established at initialize time) instead of . - O

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • npm @aborrusoversion unspecified
  • npm @aborruso/ckan-mcp-server0 → 0.4.112
  • npm @aborruso/ckan-mcp-server< 0.4.112

How to fix CVE-2026-76894

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

Exploitation likelihood is not on this record for CVE-2026-76894. A missing EPSS score is not a low risk. Compare ckan-mcp-server: DataStore Table UI with the linked advisory before you change production.

Which versions are affected?

Compare what you have installed with 0 → 0.4.112, < 0.4.112. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

CWE-345: Insufficient Verification of Data Authenticity; CWE-940. EPSS is absent from the current FIRST dataset. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 16, 2026 · GitHub Advisory Database

    Detected

    ## Summary The MCP Apps UI resource (an interactive DataStore table rendered in the host's webview/iframe) communicates with its parent via . Its inbound listener performs no validation, and its outbound messages are sent with target origin . Any window/frame able to reach the document can inject data into the table and interfere with the MCP UI handshake, and the UI's own JSON-RPC messages are br

  2. Oct 16, 2026 · GitHub Advisory Database

    Fix available

    @aborruso/ckan-mcp-server fixed in 0.4.112

  3. Oct 16, 2026 · GitHub Advisory Database

    Fix available

    @aborruso/ckan-mcp-server fixed in 0.4.112

  4. Oct 16, 2026 · GitHub Advisory Database

    Updated

    ## Summary The MCP Apps UI resource (an interactive DataStore table rendered in the host's webview/iframe) communicates with its parent via . Its inbound listener performs no validation, and its outbound messages are sent with target origin . Any window/frame able to reach the document can inject data into the table and interfere with the MCP UI handshake, and the UI's own JSON-RPC messages are br

Sources

  • CVE.orgVulnerability recordCVE-2026-76894

    Official CVE identifier

    cve.org
  • GitHub Advisory DatabasePackage advisoryGHSA-vqff-r82h-9crc

    ckan-mcp-server: DataStore Table UI resource does not validate postMessage origin (in) and posts to targetOrigin "*" (out)

    github.com
  • GitLab Advisory DatabasePackage advisoryCVE-2026-76894

    The MCP Apps UI resource (an interactive DataStore table rendered in the host's webview/iframe) communicates with its parent via postMessage. Its inbound message listener performs no event.origin validation, and its outbound messages are sent with target origin '*'. Any window/frame able to reach the document can inject data into the table and interfere with the MCP UI handshake, and the UI's own

    advisories.gitlab.com
  • OpenSSF OSV / OSV ScannerPackage advisoryGHSA-vqff-r82h-9crc

    ckan-mcp-server: DataStore Table UI resource does not validate postMessage origin (in) and posts to targetOrigin "*" (out)

    osv.dev

References

Freshness

Last verified in this catalog Oct 18, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.