PT-2026-36817 · Ckan+2 · Ckan

Published 2026-04-30 · Updated 2026-05-13 · CVE-2026-42032

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions CKAN versions prior to 2.10.10 CKAN versions prior to 2.11.5

Description An issue in the datastore search sql function allows attackers to bypass authorization. This can lead to unauthorized access to private resources and PostgreSQL system information.

Recommendations Update to version 2.10.10. Update to version 2.11.5. As a temporary workaround, disable the DataStore SQL search by setting ckan.datastore.sqlsearch.enabled = false. Restrict the use of the datastore search sql function using an IAuthFunctions plugin.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2026-42032

GHSA-CG4X-64P3-X59H

Affected Products

Ckan

References · 10

• https://github.com/ckan/ckan/security/advisories/GHSA-cg4x-64p3-x59h · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-cg4x-64p3-x59h · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-42032 · Security Note
• https://github.com/ckan/ckan · Note
• https://docs.ckan.org/en/2.11/extensions/plugin-interfaces.html#ckan.plugins.interfaces.IAuthFunctions · Note
• https://docs.ckan.org/en/2.11/changelog.html#v-2-11-5-2026-04-29 · Note
• https://docs.ckan.org/en/2.10/changelog.html#v-2-10-10-2026-04-29 · Note
• https://twitter.com/VulmonFeeds/status/2054701600480919555 · Twitter Post
• https://reddit.com/r/VulnMatter/comments/1t3jriw/resumen_diario_de_vulnerabilidades_04052026 · Reddit Post
• https://docs.ckan.org/en/2.11/maintaining/configuration.html#ckan-datastore-sqlsearch-enabled · Note