Is CVE-2026-33060 actively exploited?

No active exploitation of CVE-2026-33060 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-33060 be exploited remotely?

Yes. CVE-2026-33060 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-33060?

CVE-2026-33060 has a CVSS score of 5.3 (MEDIUM).

HOME VULNERABILITIESCVE-2026-33060

MEDIUM

CVE-2026-33060

CWE-918Published: March 20, 2026· Updated: Mar 20, 2026

5.3

CVSS v3.1

EPSS:0.01%probability of exploitation in 30 daysPercentile:1.1th

Official Description

CKAN MCP Server is a tool for querying CKAN open data portals. Versions prior to 0.4.85 provide tools including ckan_package_search and sparql_query that accept a base_url parameter, making HTTP requests to arbitrary endpoints without restriction. A CKAN portal client has no legitimate reason to contact cloud metadata or internal network services. There is no URL validation on base_url parameter. No private IP blocking (RFC 1918, link-local 169.254.x.x), no cloud metadata blocking. The sparql_query and ckan_datastore_search_sql tools also accept arbitrary base URLs and expose injection surfaces. An attack can lead to internal network scanning, cloud metadata theft (IAM credentials via IMDS at 169.254.169.254), potential SQL/SPARQL injection via unsanitized query parameters. Attack requires prompt injection to control the base_url parameter. This issue has been fixed in version 0.4.85.

NVD Source

Technical Analysis

CVE-2026-33060 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

A successful exploit results in complete confidentiality breach (data exposure), with a CVSS base score of 5.3.