PT-2026-37108 · Ckan · Ckan

CVE-2026-41132 · Published 2026-04-29 · Updated 2026-07-13

Positive Technologies (AI Summary)

CVSS v3.1

7.4

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions CKAN versions prior to 2.10.10 CKAN versions prior to 2.11.5

Description The configured SMTP server may be spoofed using any certificate, such as a self-signed one. This allows for Man-in-the-Middle (MITM) attacks, where an attacker intercepts communication between two parties, potentially exposing credentials and all transmitted emails.

Recommendations Update to version 2.10.10. Update to version 2.11.5.

Exploit

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

CVE-2026-41132

GHSA-MPFM-FPGX-647Q

PYSEC-2026-2419

Affected Products

Ckan

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41132.json · Exploit
• https://github.com/ckan/ckan/security/advisories/GHSA-mpfm-fpgx-647q · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2026-2419 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-41132 · Security Note
• https://osv.dev/vulnerability/CVE-2026-41132 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-mpfm-fpgx-647q · Vendor Advisory
• https://github.com/ckan/ckan · Note
• https://docs.ckan.org/en/2.10/changelog.html#v-2-10-10-2026-04-29 · Note
• https://twitter.com/VulmonFeeds/status/2054704160361095309 · Twitter Post
• https://pypi.org/project/ckan · Note
• https://docs.ckan.org/en/2.11/changelog.html#v-2-11-5-2026-04-29 · Note
• https://github.com/advisories/GHSA-mpfm-fpgx-647q · Note