CVE-2026-76894

CKAN MCP Server is a tool for querying CKAN open data portals. Prior to 0.4.112, the DataStore table UI in src/resources/datastore-table-ui.ts accepts window message events without validating event.origin and sends JSON-RPC messages through postMessage with a wildcard target origin. A frame that can reach the embedded document can inject fabricated fields or records, spoof pending ui/initialize responses, disrupt the MCP UI handshake, or receive outbound messages when the resource is embedded by an untrusted parent. Values are HTML escaped, so the demonstrated content injection is display spoofing rather than script execution, and exploitability depends on the host embedding model. This issue is fixed in version 0.4.112.

• CWE-345
• CWE-940

• https://github.com/ondata/ckan-mcp-server/commit/3b827af72b228d42aa7b0d7dac5347d16af3f4e5
• https://github.com/ondata/ckan-mcp-server/releases/tag/v0.4.112
• https://github.com/ondata/ckan-mcp-server/security/advisories/GHSA-vqff-r82h-9crc

Published

Nov 3, 2026

Last Modified

Nov 3, 2026

Status

Received

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-76889UMTS FP protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0…5.5
• CVE-2026-7689A security flaw has been discovered in Dolibarr ERP CRM up t…3.7
• CVE-2026-76890Crash in sharkd in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows…6.5
• CVE-2026-76891Crash in sharkd in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows…6.5
• CVE-2026-76892tsParticles is a TypeScript library for creating highly cust…8.7
• CVE-2026-76893tsParticles is a TypeScript library for creating highly cust…6.9
• CVE-2026-76898draw.io is a configurable diagramming and whiteboarding appl…7.7
• CVE-2026-76899CordysCRM is an open source AI-powered customer relationship…5.7
• CVE-2026-7690A weakness has been identified in Wavlink WL-WN570HA1 R70HA1…9.8
• CVE-2026-76900CordysCRM is an open source AI-powered customer relationship…6.8
• CVE-2026-76901CordysCRM is an open source AI-powered customer relationship…5.8
• CVE-2026-76902CordysCRM is an open source AI-powered customer relationship…5