CVE-2026-41255Medium· 6.1▾ SunlitCKAN has CSRF exemption primed by anonymous requests
▾ Sunlit zone — Low / medium · no exploitation signal
impact 33.6 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 13.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
0.1%
Views can be marked as exempt from CSRF protection
Access to the views via tokens or unauthenticated requests marked the endpoint as not requiring CSRF protection.
The marking was a member variable in flask-wtf.csrf.CSRFProtect(), which was stored as a module level variable in the flask_app middleware. Thsi API was never intended for request level changes, it is primarily a decorator for static configuration.
An unauthenticated request could hit a protected endpoint, exempting it from CSRF protection for the life of the particular server process. (e.g. one worker of uwsgi).
This could be leveraged with XSS to perform actions using other user's credentials.
ckan >= 2.10.0, < 2.10.10ckan >= 2.11.0, < 2.11.5Upgrade to a patched release:
ckan 2.10.10ckan 2.11.5Connected by shared product, vendor, weakness, or advisory.
CVE-2026-41132MediumCKAN has no certificate validation on STMP connection
CVE-2026-42031HighCKAN has Unauthenticated SQL Injection and Authorization Bypass in `datastore_search_sql`
CVE-2026-42032MediumCKAN has Unauthenticated Authorization Bypass in `datastore_search_sql`
CVE-2023-32321Critical· 9.8Ckan remote code execution and private information access via crafted resource ids
CVE-2024-41675Medium· 6.8CKAN has Cross-site Scripting vector in the Datatables view plugin
CVE-2024-43371Medium· 4.5Potential access to sensitive URLs via CKAN extensions (SSRF)