{"id":"CVE-2026-41132","aliases":["GHSA-mpfm-fpgx-647q","PYSEC-2026-2419"],"title":"CKAN has no certificate validation on STMP connection","summary":"CKAN has no certificate validation on STMP connection","severity":"medium","vendor":"ckan","product":"ckan","ecosystem":"pip","affected":["ckan >= 2.11.0, < 2.11.5","ckan < 2.10.10"],"patched":["ckan 2.11.5","ckan 2.10.10"],"published":"2026-04-29","updated":"2026-07-13","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-mpfm-fpgx-647q","references":[{"url":"https://github.com/ckan/ckan/security/advisories/GHSA-mpfm-fpgx-647q"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41132"},{"url":"https://docs.ckan.org/en/2.10/changelog.html#v-2-10-10-2026-04-29"},{"url":"https://docs.ckan.org/en/2.11/changelog.html#v-2-11-5-2026-04-29"},{"url":"https://github.com/ckan/ckan"}],"tags":["osv","pip"],"epss":0.00213,"epssPercentile":0.10275,"ingestedAt":"2026-07-13T18:58:00.795Z","slug":"CVE-2026-41132","body":"## Overview\n\n### Impact\nConfigured SMTP server may be spoofed with any certificate (e.g. self-signed), leaving credentials and all emails sent open to MITM attacks.\n\n### Patches\nThe vulnerability has been patched in CKAN 2.10.10 and CKAN 2.11.5\n\n## Affected packages\n\n- `ckan >= 2.11.0, < 2.11.5`\n- `ckan < 2.10.10`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `ckan 2.11.5`\n- `ckan 2.10.10`","depth":"sunlit","depthScore":28,"depthScoreParts":{"impact":27.5,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}