---
id: CVE-2026-42031
aliases:
  - GHSA-h7j7-3rx6-xvcg
  - PYSEC-2026-2417
title: >-
  CKAN has Unauthenticated SQL Injection and Authorization Bypass in
  `datastore_search_sql`
summary: >-
  CKAN has Unauthenticated SQL Injection and Authorization Bypass in
  `datastore_search_sql`
severity: high
vendor: ckan
product: ckan
ecosystem: pip
affected:
  - ckan < 2.10.10
  - 'ckan >= 2.11.0, < 2.11.5'
patched:
  - ckan 2.10.10
  - ckan 2.11.5
published: '2026-04-29'
updated: '2026-07-13'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-h7j7-3rx6-xvcg'
references:
  - url: 'https://github.com/ckan/ckan/security/advisories/GHSA-h7j7-3rx6-xvcg'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-42031'
  - url: 'https://docs.ckan.org/en/2.10/changelog.html#v-2-10-10-2026-04-29'
  - url: 'https://docs.ckan.org/en/2.11/changelog.html#v-2-11-5-2026-04-29'
  - url: >-
      https://docs.ckan.org/en/2.11/extensions/plugin-interfaces.html#ckan.plugins.interfaces.IAuthFunctions
  - url: >-
      https://docs.ckan.org/en/2.11/maintaining/configuration.html#ckan-datastore-sqlsearch-enabled
  - url: 'https://github.com/ckan/ckan'
tags:
  - osv
  - pip
  - exploit-available
epss: 0.02188
epssPercentile: 0.81658
ingestedAt: '2026-07-13T18:57:59.024Z'
exploits:
  github: 1
  githubRepos:
    - 'https://github.com/ddrvahandzo90-hue/CVE-2026-42031-SQL-Injection-Scanner'
  nuclei:
    - CVE-2026-42031
  checkedAt: '2026-09-26T09:05:43.677Z'
exploitAvailable: true
---

## Overview

### Impact

A vulnerability in `datastore_search_sql` allowed attackers to inject SQL in order to gain access to private resources and PostgreSQL system information.

### Patches
The issue has been patched in CKAN 2.10.10 and CKAN 2.11.5

### Workarounds
Disable the DataStore SQL search (`ckan.datastore.sqlsearch.enabled = false`). Note that the SQL search is disabled by default.

### More information

As stated in the [documentation](https://docs.ckan.org/en/2.11/maintaining/configuration.html#ckan-datastore-sqlsearch-enabled), this action function has protections that offer some safety but are not designed to prevent all types of abuse. Depending on the sensitivity of private data in a project's DataStore and the likelihood of abuse of a consuming site, a developer may choose to disable this action function or restrict its use with a [`IAuthFunctions`](https://docs.ckan.org/en/2.11/extensions/plugin-interfaces.html#ckan.plugins.interfaces.IAuthFunctions) plugin.

### Credits

* Reported by Arvin Shivram of Brutecat Security

## Affected packages

- `ckan < 2.10.10`
- `ckan >= 2.11.0, < 2.11.5`

## Remediation

Upgrade to a patched release:

- `ckan 2.10.10`
- `ckan 2.11.5`