Tools AI Risk Radar ai-incident-0233
Incident record
CKAN MCP table could accept messages from other frames
- Severity
- Low
- Status
- Patched
- Type
- Infra Vuln
- Target
- CKAN MCP server table interface
- Actor
- researcher
- CVE
- CVE-2026-76894
What happened
A frame able to message the embedded table could supply fabricated rows or interfere with its setup messages because the interface did not check the sender’s origin.
The maintainer describes content spoofing and messaging risks dependent on how the host embeds the interface. The fix is @aborruso/ckan-mcp-server 0.4.112. The report describes a browser test; displayed values are escaped.
Sources
- Maintainer security advisorygithub.com/ondata/ckan-mcp-server/security/advisories/GHSA-v…
- GitHub reviewed advisorygithub.com/advisories/GHSA-vqff-r82h-9crc
One record from the AI Risk Radar, maintained by the Security Desk.Data: CSV · JSON ·RSS · CC BY 4.0 with attribution to YFarmX.Tracker updated · 28 October 2026