Ckan mcp server: ckan-mcp-server: DataStore Table UI resource does not validate postMessage origin (in) and posts to targetOrigin "*" (out) (CVE-2026-76894)

The MCP Apps UI resource in the CKAN MCP server uses postMessage for communication with its parent window but does not validate the origin of incoming messages (no event.origin check) and sends outbound messages with targetOrigin '*'. This lack of origin validation allows any frame able to postMessage to the UI to inject arbitrary fields and records, leading to content spoofing in the DataStore table UI. Additionally, the UI's JSON-RPC handshake can be interfered with by spoofed responses, and outbound messages may leak to unintended recipients if embedded in untrusted contexts. The vulnerability affects versions prior to 0.4.112. A patch is available to enforce origin validation and restrict outbound message targets.

An attacker controlling a frame that can postMessage to the UI can inject fabricated data into the DataStore table, causing content spoofing such as fake rows and links that appear legitimate. The attacker can also disrupt the UI's handshake by spoofing responses to pending requests, potentially interfering with user experience. Outbound JSON-RPC messages are sent to all origins ('*'), risking data leakage if the UI is embedded in an untrusted context. However, no cross-site scripting (XSS) is possible as values are HTML-escaped. The exploitability depends on the embedding model, making this primarily a hardening issue with low severity.

A fix is available. Users should update to version 0.4.112 or later where inbound postMessage events are validated against the expected host origin, and outbound messages specify an explicit target origin instead of '*'. Additionally, binding communication to a nonce or channel established during initialization can further restrict message handling to the trusted host. Until patched, restricting embedding contexts to trusted origins can reduce risk.