CVE-2026-73845

This CVE exposes more than a single flawed regex—it reveals a systemic failure in how this codebase reasons about URL validation. The vulnerability exists in isValidMqaServer, a shared validation function used by both ckan_get_mqa_quality and ckan_get_mqa_quality_details tools. This shared utility is the real signal: when one developer builds flawed URL validation and centralizes it, every tool consuming that utility inherits the same conceptual error. Two tools failed here because they drew from the same broken mental model. The prefix-only matching pattern—checking if a URL starts with dati.gov.it rather than validating the entire domain—represents a cognitive trap so common in SSRF vulnerabilities that calling it an antipattern undersells its persistence. The developer reasoning is intuitive: "this URL must point to dati.gov.it, so I'll check if it starts with dati.gov.it." What's missed is that URL parsing has subcomponents (userinfo, fragments, ports) that create valid bypass paths even when the domain prefix check passes. This isn't laziness; it's a mental model misalignment with RFC 3986 reality. The MCP server architecture amplifies the risk beyond what CVSS 5.3 suggests. These servers maintain persistent sessions, carry tokens, and operate with elevated trust relative to internal CKAN instances. An attacker exploiting this SSRF doesn't just make a forged request—they land in a context with access to resources that may be network-isolated from the public internet. The CVSS rating assumes a network-accessible target, but the post-exploitation access surface could be severe. The version number is telling: 0.4.112 signals embryonic software, likely written before mature security review processes. The fix in this version probably anchored the regex—a common recidivist patch that resolves the CVE without resolving the underlying assumption about what URL validation requires. Expect follow-up disclosures if downstream libraries handle other URL components (fragments, punycode, non-standard ports) differently than expected. Audit the codebase for other prefix-only validation patterns. If isValidMqaServer was written this way, check every other URL-validation point. The exposure window extends beyond typical timelines because MCP servers don't auto-update through package managers—they're standalone processes with update cycles measured in months. Organizations running this tool may not even know they need to patch.

Reviewed through automated stages and approved by a human before publication.