Skip to content

Commit 48491f5

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-3xm7-qw7j-qc8v GHSA-6g7g-w4f8-9c9x GHSA-h9q6-hc68-35rp GHSA-jqcq-xjh3-6g23 GHSA-r8x2-fhmf-6mxp GHSA-wgvc-ghv9-3pmm GHSA-wmrf-hv6w-mr66
1 parent cb8a9c3 commit 48491f5

7 files changed

Lines changed: 478 additions & 0 deletions

File tree

‎advisories/github-reviewed/2026/03/GHSA-3xm7-qw7j-qc8v/GHSA-3xm7-qw7j-qc8v.json‎

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-3xm7-qw7j-qc8v",
4+
"modified": "2026-03-18T12:59:42Z",
5+
"published": "2026-03-18T12:59:42Z",
6+
"aliases": [
7+
"CVE-2026-33060"
8+
],
9+
"summary": "SSRF in @aborruso/ckan-mcp-server via base_url allows access to internal networks",
10+
"details": "## Summary\n\nThe `@aborruso/ckan-mcp-server` MCP server provides tools including `ckan_package_search` and `sparql_query` that accept a `base_url` parameter, making HTTP requests to arbitrary endpoints without restriction. A CKAN portal client has no legitimate reason to contact cloud metadata or internal network services.\n\n## Severity\n\nAttack complexity is HIGH because exploitation requires prompt injection via malicious content (webpage, document) while the victim's AI assistant has this MCP server connected.\n\n## Proof of Concept\n\nTested inside Docker-in-Docker isolated environment with canary HTTP sidecar.\n\n```json\n{\"tool\": \"ckan_package_search\", \"arguments\": {\"base_url\": \"http://canary:8080/ssrf\", \"query\": \"test\"}}\n```\n**Result**: Canary received **9 HTTP requests**. The high request volume confirms no rate limiting or URL validation.\n\n## Root Cause\n\nNo URL validation on `base_url` parameter. No private IP blocking (RFC 1918, link-local 169.254.x.x), no cloud metadata blocking. The `sparql_query` and `ckan_datastore_search_sql` tools also accept arbitrary base URLs and expose injection surfaces.\n\n## Impact\n\nInternal network scanning, cloud metadata theft (IAM credentials via IMDS at 169.254.169.254), potential SQL/SPARQL injection via unsanitized query parameters. Attack requires prompt injection to control the `base_url` parameter.\n\n## Recommended Fix\n\n1. Validate `base_url` against a configurable allowlist of permitted CKAN portals\n2. Block private IP ranges (RFC 1918, link-local)\n3. Block cloud metadata endpoints (169.254.169.254)\n4. Sanitize SQL input for datastore queries\n5. SPARQL endpoint allowlist\n\n## Credit\n\nDiscovered by [Andrei Boldyrev](https://github.com/abcgco) of Munio Security Research using [munio](https://munio.dev)",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "npm",
21+
"name": "@aborruso/ckan-mcp-server"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "0.4.85"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
38+
"references": [
39+
{
40+
"type": "WEB",
41+
"url": "https://github.com/ondata/ckan-mcp-server/security/advisories/GHSA-3xm7-qw7j-qc8v"
42+
},
43+
{
44+
"type": "WEB",
45+
"url": "https://github.com/kysely-org/kysely/commit/0a602bff2f442f6c26d5e047ca8f8715179f6d24"
46+
},
47+
{
48+
"type": "PACKAGE",
49+
"url": "https://github.com/ondata/ckan-mcp-server"
50+
}
51+
],
52+
"database_specific": {
53+
"cwe_ids": [
54+
"CWE-918"
55+
],
56+
"severity": "MODERATE",
57+
"github_reviewed": true,
58+
"github_reviewed_at": "2026-03-18T12:59:42Z",
59+
"nvd_published_at": null
60+
}
61+
}

‎advisories/github-reviewed/2026/03/GHSA-6g7g-w4f8-9c9x/GHSA-6g7g-w4f8-9c9x.json‎

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-6g7g-w4f8-9c9x",
4+
"modified": "2026-03-18T13:00:19Z",
5+
"published": "2026-03-18T13:00:19Z",
6+
"aliases": [],
7+
"summary": "Denial of service in github.com/buger/jsonparser",
8+
"details": "The Delete function fails to properly validate offsets when processing malformed JSON input. This can lead to a negative slice index and a runtime panic, allowing a denial of service attack.",
9+
"severity": [
10+
{
11+
"type": "CVSS_V3",
12+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
13+
}
14+
],
15+
"affected": [
16+
{
17+
"package": {
18+
"ecosystem": "Go",
19+
"name": "github.com/buger/jsonparser"
20+
},
21+
"ranges": [
22+
{
23+
"type": "ECOSYSTEM",
24+
"events": [
25+
{
26+
"introduced": "0"
27+
},
28+
{
29+
"last_affected": "1.1.1"
30+
}
31+
]
32+
}
33+
]
34+
}
35+
],
36+
"references": [
37+
{
38+
"type": "WEB",
39+
"url": "https://github.com/buger/jsonparser/issues/275"
40+
},
41+
{
42+
"type": "WEB",
43+
"url": "https://github.com/golang/vulndb/issues/4514"
44+
},
45+
{
46+
"type": "WEB",
47+
"url": "https://cyber.securityinfinity.com/buger-jsonparser-negative-slice-panic-dos-2026"
48+
},
49+
{
50+
"type": "PACKAGE",
51+
"url": "https://github.com/buger/jsonparser"
52+
}
53+
],
54+
"database_specific": {
55+
"cwe_ids": [
56+
"CWE-125"
57+
],
58+
"severity": "HIGH",
59+
"github_reviewed": true,
60+
"github_reviewed_at": "2026-03-18T13:00:19Z",
61+
"nvd_published_at": null
62+
}
63+
}

‎advisories/github-reviewed/2026/03/GHSA-h9q6-hc68-35rp/GHSA-h9q6-hc68-35rp.json‎

Lines changed: 82 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,82 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-h9q6-hc68-35rp",
4+
"modified": "2026-03-18T12:59:54Z",
5+
"published": "2026-03-18T12:59:54Z",
6+
"aliases": [],
7+
"summary": "Denial of service in github.com/shamaton/msgpack",
8+
"details": "The msgpack decoder fails to properly validate the input buffer length when processing truncated fixext data (format codes 0xd4-0xd8). This can lead to an out-of-bounds read and a runtime panic, allowing a denial of service attack.",
9+
"severity": [
10+
{
11+
"type": "CVSS_V3",
12+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
13+
}
14+
],
15+
"affected": [
16+
{
17+
"package": {
18+
"ecosystem": "Go",
19+
"name": "github.com/shamaton/msgpack/v2"
20+
},
21+
"ranges": [
22+
{
23+
"type": "ECOSYSTEM",
24+
"events": [
25+
{
26+
"introduced": "0"
27+
},
28+
{
29+
"last_affected": "2.4.0"
30+
}
31+
]
32+
}
33+
]
34+
},
35+
{
36+
"package": {
37+
"ecosystem": "Go",
38+
"name": "github.com/shamaton/msgpack/v3"
39+
},
40+
"ranges": [
41+
{
42+
"type": "ECOSYSTEM",
43+
"events": [
44+
{
45+
"introduced": "0"
46+
},
47+
{
48+
"last_affected": "3.1.0"
49+
}
50+
]
51+
}
52+
]
53+
}
54+
],
55+
"references": [
56+
{
57+
"type": "WEB",
58+
"url": "https://github.com/golang/vulndb/issues/4513"
59+
},
60+
{
61+
"type": "WEB",
62+
"url": "https://github.com/shamaton/msgpack/issues/59"
63+
},
64+
{
65+
"type": "PACKAGE",
66+
"url": "https://github.com/shamaton/msgpack"
67+
},
68+
{
69+
"type": "WEB",
70+
"url": "https://securityinfinity.com/research/shamaton-msgpack-oob-panic-fixext-dos-2026"
71+
}
72+
],
73+
"database_specific": {
74+
"cwe_ids": [
75+
"CWE-125"
76+
],
77+
"severity": "HIGH",
78+
"github_reviewed": true,
79+
"github_reviewed_at": "2026-03-18T12:59:54Z",
80+
"nvd_published_at": null
81+
}
82+
}

‎advisories/github-reviewed/2026/03/GHSA-jqcq-xjh3-6g23/GHSA-jqcq-xjh3-6g23.json‎

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-jqcq-xjh3-6g23",
4+
"modified": "2026-03-18T13:00:31Z",
5+
"published": "2026-03-18T13:00:31Z",
6+
"aliases": [],
7+
"summary": "Denial of service in github.com/jackc/pgproto3/v2",
8+
"details": "The DataRow.Decode function fails to properly validate field lengths. A malicious or compromised PostgreSQL server can send a DataRow message with a negative field length, causing a slice bounds out of range panic.",
9+
"severity": [
10+
{
11+
"type": "CVSS_V3",
12+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
13+
}
14+
],
15+
"affected": [
16+
{
17+
"package": {
18+
"ecosystem": "Go",
19+
"name": "github.com/jackc/pgproto3/v2"
20+
},
21+
"ranges": [
22+
{
23+
"type": "ECOSYSTEM",
24+
"events": [
25+
{
26+
"introduced": "2.0.0"
27+
},
28+
{
29+
"last_affected": "2.3.3"
30+
}
31+
]
32+
}
33+
]
34+
}
35+
],
36+
"references": [
37+
{
38+
"type": "WEB",
39+
"url": "https://github.com/golang/vulndb/issues/4518"
40+
},
41+
{
42+
"type": "WEB",
43+
"url": "https://github.com/jackc/pgx/issues/2507"
44+
},
45+
{
46+
"type": "PACKAGE",
47+
"url": "https://github.com/jackc/pgproto3"
48+
},
49+
{
50+
"type": "WEB",
51+
"url": "https://securityinfinity.com/research/memory-safety-vulnerabilities-in-go-postgresql-wire-protocol-parsers-pgproto3-pgx"
52+
}
53+
],
54+
"database_specific": {
55+
"cwe_ids": [
56+
"CWE-129"
57+
],
58+
"severity": "HIGH",
59+
"github_reviewed": true,
60+
"github_reviewed_at": "2026-03-18T13:00:31Z",
61+
"nvd_published_at": null
62+
}
63+
}

‎advisories/github-reviewed/2026/03/GHSA-r8x2-fhmf-6mxp/GHSA-r8x2-fhmf-6mxp.json‎

Lines changed: 73 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,73 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-r8x2-fhmf-6mxp",
4+
"modified": "2026-03-18T13:00:56Z",
5+
"published": "2026-03-18T13:00:56Z",
6+
"aliases": [
7+
"CVE-2026-32811"
8+
],
9+
"summary": "Heimdall: Path received via Envoy gRPC corrupted when containing query string",
10+
"details": "### Summary\nWhen using heimdall in envoy gRPC decision API mode, wrong encoding of the query URL string allows rules with non-wildcard path expressions to be bypassed.\n\nThe HTTP based decision API is NOT affected, and proxy mode is NOT affected either.\n\n**Note:** The issue can only lead to unintended access if heimdall is configured with an \"allow all\" default rule. Since v0.16.0, heimdall enforces secure defaults and refuses to start with such a configuration unless this enforcement is explicitly disabled, e.g. via `--insecure-skip-secure-default-rule-enforcement` or the broader `--insecure` flag.\n\n### Details\nEnvoy splits the requested URL into parts, and sends the parts individually to heimdall. Although `query` and `path` are present in the API, the `query` field is documented to be always empty and the URL query is included in the `path` field [1].\n\nThe implementation uses go's url library to reconstruct the url which automatically encodes special characters in the path. \n\n https://github.com/dadrus/heimdall/blob/1faba9e4160bd7ab3240cf6aa418e21bfef3401a/internal/handler/envoyextauth/grpcv3/request_context.go#L109-L115\n\nAs a consequence, a parameter like `/mypath?foo=bar` to `Path` is escaped into `/mypath%3Ffoo=bar`. Subsequently, a rule matching `/mypath` no longer matches and is bypassed.\n\n\n### PoC\n\nUsing the example docker compose setup, the `demo:public` rule is bypassed when adding a query parameter.\n\n> docker compose -f docker-compose-envoy-grpc.yaml -f docker-compose.yaml up\n\n```\ncurl http://127.0.0.1:9090/public\nHostname: 80201fead1c7\nIP: 127.0.0.1\nIP: ::1\nIP: 172.23.0.3\nRemoteAddr: 172.23.0.5:37056\nGET /public HTTP/1.1\nHost: 127.0.0.1:9090\nUser-Agent: curl/8.19.0\nAccept: */*\nX-Envoy-Expected-Rq-Timeout-Ms: 15000\nX-Forwarded-Proto: http\nX-Request-Id: 0a1f0f06-75ef-4f14-92af-16162ea1d9e5\n\ncurl -v http://127.0.0.1:9090/public?bypass\n* Trying 127.0.0.1:9090...\n* Established connection to 127.0.0.1 (127.0.0.1 port 9090) from 127.0.0.1 port 47876 \n* using HTTP/1.x\n> GET /public?hallo HTTP/1.1\n> Host: 127.0.0.1:9090\n> User-Agent: curl/8.19.0\n> Accept: */*\n> \n* Request completely sent off\n< HTTP/1.1 401 Unauthorized\n< date: Sat, 14 Mar 2026 16:34:17 GMT\n< server: envoy\n< content-length: 0\n< \n* Connection #0 to host 127.0.0.1:9090 left intact\n```\n\nWhen using the HTTP decision API variant, the second request is matched by the rule as well:\n\n> docker compose -f docker-compose-envoy-http.yaml -f docker-compose.yaml up\n\n```\ncurl http://127.0.0.1:9090/public?bypass\nHostname: 80201fead1c7\nIP: 127.0.0.1\nIP: ::1\nIP: 172.23.0.4\nRemoteAddr: 172.23.0.2:38044\nGET /public?hallo HTTP/1.1\nHost: 127.0.0.1:9090\nUser-Agent: curl/8.19.0\nAccept: */*\nX-Envoy-Expected-Rq-Timeout-Ms: 15000\nX-Forwarded-Proto: http\nX-Request-Id: 5c961bc6-ad03-4a44-982b-abe04566fdd2\n```\n\n### Impact\n\nEveryone using heimdall with the envoy gRPC API may be affected. Users who configured a deny list in heimdall (with an allow-all default rule) are affected, as attackers can potentially circumvent a specific block rule by adding query parameters.\n\n[1] https://github.com/envoyproxy/envoy/blob/105b4acd422d67fcff908ec38d91c7676d079939/api/envoy/service/auth/v3/attribute_context.proto#L146-L147",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Go",
21+
"name": "github.com/dadrus/heimdall"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0.7.0-alpha"
29+
},
30+
{
31+
"fixed": "0.17.11"
32+
}
33+
]
34+
}
35+
],
36+
"database_specific": {
37+
"last_known_affected_version_range": "<= 0.17.10"
38+
}
39+
}
40+
],
41+
"references": [
42+
{
43+
"type": "WEB",
44+
"url": "https://github.com/dadrus/heimdall/security/advisories/GHSA-r8x2-fhmf-6mxp"
45+
},
46+
{
47+
"type": "WEB",
48+
"url": "https://github.com/dadrus/heimdall/pull/3106"
49+
},
50+
{
51+
"type": "WEB",
52+
"url": "https://github.com/dadrus/heimdall/commit/50321b3007db1ccafdc6b1cfd6bdc3689c19a502"
53+
},
54+
{
55+
"type": "PACKAGE",
56+
"url": "https://github.com/dadrus/heimdall"
57+
},
58+
{
59+
"type": "WEB",
60+
"url": "https://github.com/envoyproxy/envoy/blob/105b4acd422d67fcff908ec38d91c7676d079939/api/envoy/service/auth/v3/attribute_context.proto#L146-L147"
61+
}
62+
],
63+
"database_specific": {
64+
"cwe_ids": [
65+
"CWE-116",
66+
"CWE-863"
67+
],
68+
"severity": "HIGH",
69+
"github_reviewed": true,
70+
"github_reviewed_at": "2026-03-18T13:00:56Z",
71+
"nvd_published_at": null
72+
}
73+
}

0 commit comments

Comments
 (0)