---
id: CVE-2024-41674
aliases:
  - GHSA-2rqw-cfhc-35fh
  - PYSEC-2026-1248
title: CKAN may leak Solr credentials via error message in package_search action
summary: CKAN may leak Solr credentials via error message in package_search action
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'
vendor: ckan
product: ckan
ecosystem: pip
affected:
  - 'ckan >= 2.0.0, < 2.10.5'
patched:
  - ckan 2.10.5
published: '2024-08-21'
updated: '2026-07-07'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-2rqw-cfhc-35fh'
references:
  - url: 'https://github.com/ckan/ckan/security/advisories/GHSA-2rqw-cfhc-35fh'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2024-41674'
  - url: >-
      https://github.com/ckan/ckan/commit/f6b032cd7082d784938165bbd113557639002ca7
  - url: 'https://github.com/ckan/ckan'
tags:
  - osv
  - pip
epss: 0.0038
epssPercentile: 0.29204
ingestedAt: '2026-07-08T18:25:44.619Z'
---

## Overview

If there were connection issues with the Solr server, the internal Solr URL (potentially including credentials) could be leaked to `package_search` calls as part of the returned error message

### Patches
This has been patched in CKAN 2.10.5 and 2.11.0


## Affected packages

- `ckan >= 2.0.0, < 2.10.5`

## Remediation

Upgrade to a patched release:

- `ckan 2.10.5`