The ckan-mcp-server tool from ondata has a vulnerability (CVE-2026-73846) in versions before 0.4.112 where the canonicalizeParams function in src/utils/cache.ts serializes request parameters without escaping ampersand, equals-sign, and vertical-bar delimiters. This improper serialization causes different logical parameter sets to produce identical cache keys, allowing an attacker to manipulate the shared cache by injecting responses for distinct victim queries. This vulnerability is classified under CWE-345 (Insufficient Verification of Data Authenticity) and CWE-436. The issue is resolved in version 0.4.112.

An attacker can cause cache poisoning by exploiting the collision of cache keys, potentially leading to the victim receiving incorrect or malicious cached responses. The CVSS score of 6.5 (medium severity) reflects a network attack vector with high impact on integrity but low impact on confidentiality and no impact on availability. There is no indication of known exploits in the wild.

Upgrade to version 0.4.112 or later, where the vulnerability is fixed by properly escaping delimiters in request parameter serialization to prevent cache key collisions. Patch status is confirmed by the vendor's versioning information.