PT-2026-36110 · Ckan · Ckan

Published 2026-04-29 · Updated 2026-05-13 · CVE-2026-42031

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions CKAN versions prior to 2.10.10 CKAN versions prior to 2.11.5

Description A SQL injection flaw exists in the datastore search sql function. This allows attackers to inject SQL commands to gain unauthorized access to private resources and PostgreSQL system information.

Recommendations Update to version 2.10.10. Update to version 2.11.5. As a temporary workaround, disable the DataStore SQL search by setting ckan.datastore.sqlsearch.enabled = false. Restrict the use of the datastore search sql function using an IAuthFunctions plugin.

Fix

Incorrect Authorization

SQL injection

Weakness Enumeration

CWE-863

CWE-89

Related Identifiers

CVE-2026-42031

GHSA-H7J7-3RX6-XVCG

Affected Products

Ckan

References · 12

• https://github.com/ckan/ckan/security/advisories/GHSA-h7j7-3rx6-xvcg · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-h7j7-3rx6-xvcg · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-42031 · Security Note
• https://github.com/ckan/ckan · Note
• https://docs.ckan.org/en/2.11/changelog.html#v-2-11-5-2026-04-29 · Note
• https://twitter.com/CVEnew/status/2054709264149795110 · Twitter Post
• https://twitter.com/pdnuclei_bot/status/2051693438043836422 · Twitter Post
• https://docs.ckan.org/en/2.10/changelog.html#v-2-10-10-2026-04-29 · Note
• https://twitter.com/VulmonFeeds/status/2054696481941070181 · Twitter Post
• https://reddit.com/r/VulnMatter/comments/1szui9p/resumen_diario_de_vulnerabilidades_30042026 · Reddit Post
• https://docs.ckan.org/en/2.11/maintaining/configuration.html#ckan-datastore-sqlsearch-enabled · Note
• https://docs.ckan.org/en/2.11/extensions/plugin-interfaces.html#ckan.plugins.interfaces.IAuthFunctions · Note