ZeroDay Findings
Sign inSign up

Findings

CVE-2026-76894

ckan-mcp-server: DataStore Table UI resource does not validate postMessage origin (in) and posts to targetOrigin "*" (out)

Published Oct 16, 2026 · corrected/updated Oct 16, 2026 · evidence confidence medium

## Summary The MCP Apps UI resource (an interactive DataStore table rendered in the host's webview/iframe) communicates with its parent via . Its inbound listener performs no validation, and its outbound messages are sent with target origin . Any window/frame able to reach the document can inject data into the table and interfere with the MCP UI handshake, and the UI's own JSON-RPC messages are broadcast without an origin restriction. ## Affected code (inline HTML): There is no allowlist of accepted origins for inbound messages and no fixed target origin for outbound messages. ## Impact - **Content spoofing.** A frame that can to the UI can supply arbitrary / , causing the table to render fabricated rows and links (e.g. a phishing ) that appear to come from the queried portal. (Values are HTML-escaped, so this is display spoofing, not script injection — no XSS.) - **Handshake/UX interference.** Because inbound messages matching a pending resolve/reject the UI's MCP requests, an attacker frame can spoof responses to the handshake or otherwise disrupt the panel. - **Outbound leakage.** Posting to means the UI's JSON-RPC messages are delivered to whatever the parent origin is; if the resource is ever embedded by a context other than the trusted host, those messages leak to it. Exploitability depends on the host embedding model (in a correct MCP Apps host the parent is the trusted host, which limits who can message the frame), so this is a hardening / defense-in-depth issue rather than a directly remotely-triggerable one — hence Low. ## Proof of concept - — static confirmation that the listener has no origin check and outbound uses : - — a page that embeds the UI and injects fabricated rows cross-origin with no handshake; the UI renders them. ## Remediation - Validate against the expected host origin on every inbound message; drop messages from other origins. - Send outbound with an explicit target origin (the host origin established at initialize time) instead of . - O

Grounded briefings

Catalog interpretations for three audiences. Each brief cites ingested metadata and the original advisories below. They are not independent research and they do not invent exploit steps.

Executive

CVE-2026-76894 is a low public vulnerability record for this product. It is not currently listed in the CISA Known Exploited catalog. Check the linked vendor or CERT advisories for patch status. This summary is a catalog interpretation of the ingested metadata and cites the original advisories below.

System administrator

Identify whether this product is in your estate, then compare installed versions with the affected ranges. Affected packages or ranges on record: @aborruso/ckan-mcp-server (0 → 0.4.112). Check the linked vendor or CERT advisories for patch status. Prefer the vendor or distribution advisory linked in Sources before changing production systems. This is a catalog interpretation, not a runbook.

Security analyst

Signals on file: CVSS 3.1. It is not currently listed in the CISA Known Exploited catalog. Weakness classes: CWE-345, CWE-940. Sources contributing to this record: github, osv. Public exploit references, when present, are outbound links only and are not proof of active exploitation. This is a catalog interpretation of stored metadata.

Exploitation and remediation

  • Exploitation evidence

    Not listed as known exploited in CISA KEV. Not in CISA KEV or VulnCheck KEV.

  • Patch and remediation

    No required-action text is stored yet. Use the vendor or CERT links in Sources for patch availability.

  • Safe detection guidance

    Compare installed versions with the affected ranges below and verify the advisory from the original publisher. This site stores metadata and outbound links only; it does not ship exploit code or proof-of-concept payloads.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 16, 2026 · GitHub Advisory Database

    Detected

    ## Summary The MCP Apps UI resource (an interactive DataStore table rendered in the host's webview/iframe) communicates with its parent via . Its inbound listener performs no validation, and its outbound messages are sent with target origin . Any window/frame able to reach the document can inject data into the table and interfere with the MCP UI handshake, and the UI's own JSON-RPC messages are br

  2. Oct 16, 2026 · GitHub Advisory Database

    Fix available

    @aborruso/ckan-mcp-server fixed in 0.4.112

  3. Oct 16, 2026 · GitHub Advisory Database

    Fix available

    @aborruso/ckan-mcp-server fixed in 0.4.112

  4. Oct 16, 2026 · GitHub Advisory Database

    Updated

    ## Summary The MCP Apps UI resource (an interactive DataStore table rendered in the host's webview/iframe) communicates with its parent via . Its inbound listener performs no validation, and its outbound messages are sent with target origin . Any window/frame able to reach the document can inject data into the table and interfere with the MCP UI handshake, and the UI's own JSON-RPC messages are br

Affected

  • npm @aborruso/ckan-mcp-server0 → 0.4.112

Sources

References