CKAN has CSRF exemption primed by anonymous requests
Views can be marked as exempt from CSRF protection
Access to the views via tokens or unauthenticated requests marked the endpoint as not requiring CSRF protection.
The marking was a member variable in flask-wtf.csrf.CSRFProtect(), which was stored as a module level variable in the flask_app middleware. Thsi API was never intended for request level changes, it is primarily a decorator for static configuration.
An unauthenticated request could hit a protected endpoint, exempting it from CSRF protection for the life of the particular server process. (e.g. one worker of uwsgi).
This could be leveraged with XSS to perform actions using other user's credentials.
References
- Vulnerability report by @Shirshaw64p (original reporter)
Software afectado
Haz clic en una tecnología para ver todas sus vulnerabilidades.
| Plataforma | Paquete | Versiones vulnerables | Corregida en |
|---|---|---|---|
| Python (PyPI) | ckan | >= 2.10.0, < 2.10.10, >= 2.11.0, < 2.11.5 | 2.10.10, 2.11.5 |
Referencias
- https://github.com/ckan/ckan/security/advisories/GHSA-mcvf-jxcw-vj73
- https://nvd.nist.gov/vuln/detail/CVE-2026-41255
- https://docs.ckan.org/en/2.10/changelog.html#v-2-10-10-2026-04-29
- https://docs.ckan.org/en/2.11/changelog.html#v-2-11-5-2026-04-29
- https://github.com/Shirshaw64p/security-advisories/tree/main/CVE-2026-41255
- https://github.com/ckan/ckan
- https://pypi.org/project/ckan
- https://github.com/advisories/GHSA-mcvf-jxcw-vj73
- Vector CVSS
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N- Debilidad (CWE)
CWE-352- Plataforma
- Python (PyPI)
- Paquete
ckan- Publicada
- 29.04.2026
- Actualizado
- 11.10.2026 14:18
Fuentes y licencias
OSV / GitHub Advisory Database - PYSEC-2026-2418 - PyPA Advisory Database; CC BY 4.0
OSV / GitHub Advisory Database - GHSA-mcvf-jxcw-vj73 - CC BY 4.0
Historial de vulnerabilidades: ckan
Todas las vulnerabilidades publicadas de este paquete (Python (PyPI)), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.
- Entradas en total
- 15
- Primera → última
- 12.2021 04.2026
- Sin corrección
- 0
- Explotada en ataques
- 0
Distribución por gravedad
- Crítica 1
- Alta 3
- Media 11
Divulgaciones por año
- 2021: 1
- 2022: 1
- 2023: 2
- 2024: 4
- 2025: 3
- 2026: 4
-
CKAN has CSRF exemption primed by anonymous requests esta entrada
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.