CVE-2026-73846

This vulnerability in the MCP server's cache key generation stems from how canonicalizeParams handles parameter stringification: it uses unescaped ampersands, equals signs, and vertical bars as delimiters. While these characters feel natural—they mirror query string conventions and | is a common separator—they create collision space that an attacker can exploit by crafting parameter sets that hash to identical cache keys. The attack requires no authentication bypass; it only requires understanding how parameter ordering and encoding map to the collision space your delimiter choice creates. The severity depends heavily on deployment context. In typical API serving, this registers as medium cache poisoning. But when the affected server sits in front of CKAN data portals serving government open data—where downstream consumers treat cached queries as authoritative—the blast radius expands to civic data integrity. A victim's legitimate query returns the attacker's primed response, corrupting decisions made on public infrastructure, health, or fiscal data. The fix in version 0.4.112 addresses the immediate escaping problem. But the deeper pattern deserves attention: this exact &/| delimiter collision has appeared in CDNs, API gateways, and caching proxies at least four times since 2015, each time treated as a novel vulnerability rather than linked to its lineage. The industry's memory of this class gets periodically erased and must be rediscovered. Security advisories, CVE entries, and CWE classifications treat each occurrence in isolation, so developers searching for "cache key collision ampersand" find no canonical reference connecting this to prior incidents. The practical question is whether your caching library provides safe canonicalization utilities that treat delimiter selection as a security-critical design decision rather than an implementation detail left to callers. If you're implementing cache key generation directly, treat delimiter escaping as mandatory—not because the logic is complex, but because the collision analysis required to verify your choice is nontrivial and rarely performed. The vulnerability class is solved; the enforcement is missing.

Reviewed through automated stages and approved by a human before publication.