CVE-2026-42032Medium▾ SunlitCKAN has Unauthenticated Authorization Bypass in `datastore_search_sql`
▾ Sunlit zone — Low / medium · no exploitation signal
impact 27.5 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 13.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
0.4%
A vulnerability in datastore_search_sql allowed attackers to bypass authorization in order to gain access to private resources and PostgreSQL system information
The issue has been patched in CKAN 2.10.10 and CKAN 2.11.5
Disable the DataStore SQL search (ckan.datastore.sqlsearch.enabled = false). Note that the SQL search is disabled by default.
As stated in the documentation, this action function has protections that offer some safety but are not designed to prevent all types of abuse. Depending on the sensitivity of private data in your DataStore and the likelihood of abuse of your site, you may choose to disable this action function or restrict its use with a IAuthFunctions plugin.
ckan < 2.10.10ckan >= 2.11.0, < 2.11.5Upgrade to a patched release:
ckan 2.10.10ckan 2.11.5Connected by shared product, vendor, weakness, or advisory.
CVE-2026-41132MediumCKAN has no certificate validation on STMP connection
CVE-2026-41255Medium· 6.1CKAN has CSRF exemption primed by anonymous requests
CVE-2026-42031HighCKAN has Unauthenticated SQL Injection and Authorization Bypass in `datastore_search_sql`
CVE-2023-32321Critical· 9.8Ckan remote code execution and private information access via crafted resource ids
CVE-2024-41675Medium· 6.8CKAN has Cross-site Scripting vector in the Datatables view plugin
CVE-2024-43371Medium· 4.5Potential access to sensitive URLs via CKAN extensions (SSRF)