PT-2026-37112 · Ckan+2 · Ckan

Published 2026-04-29 · Updated 2026-05-13 · CVE-2026-41255

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions CKAN versions prior to 2.10.10 CKAN versions prior to 2.11.5

Description Accessing views via tokens or unauthenticated requests can mark an endpoint as not requiring Cross-Site Request Forgery (CSRF) protection. This occurs because the marking is a member variable in flask-wtf.csrf.CSRFProtect(), stored as a module-level variable in the flask app middleware. Since this API is intended for static configuration rather than request-level changes, an unauthenticated request can exempt a protected endpoint from CSRF protection for the duration of the server process. This behavior could be leveraged alongside Cross-Site Scripting (XSS) to perform actions using the credentials of other users.

Recommendations Update to version 2.10.10. Update to version 2.11.5.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2026-41255

GHSA-MCVF-JXCW-VJ73

Affected Products

Ckan

References · 8

• 🔥 https://github.com/ckan/ckan/security/advisories/GHSA-mcvf-jxcw-vj73 · Exploit
• 🔥 https://github.com/Shirshaw64p/security-advisories/tree/main/CVE-2026-41255 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-41255 · Security Note
• https://osv.dev/vulnerability/GHSA-mcvf-jxcw-vj73 · Vendor Advisory
• https://github.com/ckan/ckan · Note
• https://twitter.com/CVEnew/status/2054709259527655808 · Twitter Post
• https://docs.ckan.org/en/2.11/changelog.html#v-2-11-5-2026-04-29 · Note
• https://docs.ckan.org/en/2.10/changelog.html#v-2-10-10-2026-04-29 · Note