PT-2026-37108 · Ckan+2 · Ckan

Published 2026-04-29 · Updated 2026-05-13 · CVE-2026-41132

Positive Technologies (AI Summary)

CVSS v3.1

7.4

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions CKAN versions prior to 2.10.10 CKAN versions prior to 2.11.5

Description The configured SMTP server may be spoofed using any certificate, such as a self-signed one. This allows for Man-in-the-Middle (MITM) attacks, where an attacker intercepts communication between two parties, potentially exposing credentials and all transmitted emails.

Recommendations Update to version 2.10.10. Update to version 2.11.5.

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

CVE-2026-41132

GHSA-MPFM-FPGX-647Q

Affected Products

Ckan

References · 7

• https://github.com/ckan/ckan/security/advisories/GHSA-mpfm-fpgx-647q · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-mpfm-fpgx-647q · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-41132 · Security Note
• https://github.com/ckan/ckan · Note
• https://twitter.com/VulmonFeeds/status/2054704160361095309 · Twitter Post
• https://docs.ckan.org/en/2.11/changelog.html#v-2-11-5-2026-04-29 · Note
• https://docs.ckan.org/en/2.10/changelog.html#v-2-10-10-2026-04-29 · Note