CKAN has Unauthenticated SQL Injection and Authorization Bypass in `datastore_search_sql`
Impact
A vulnerability in datastore_search_sql allowed attackers to inject SQL in order to gain access to private resources and PostgreSQL system information.
Patches
The issue has been patched in CKAN 2.10.10 and CKAN 2.11.5
Workarounds
Disable the DataStore SQL search (ckan.datastore.sqlsearch.enabled = false). Note that the SQL search is disabled by default.
More information
As stated in the documentation, this action function has protections that offer some safety but are not designed to prevent all types of abuse. Depending on the sensitivity of private data in a project's DataStore and the likelihood of abuse of a consuming site, a developer may choose to disable this action function or restrict its use with a IAuthFunctions plugin.
Credits
- Reported by Arvin Shivram of Brutecat Security
Software afectado
Haz clic en una tecnología para ver todas sus vulnerabilidades.
| Plataforma | Paquete | Versiones vulnerables | Corregida en |
|---|---|---|---|
| Python (PyPI) | ckan | < 2.10.10, >= 2.11.0, < 2.11.5 | 2.10.10, 2.11.5 |
Referencias
- https://github.com/ckan/ckan/security/advisories/GHSA-h7j7-3rx6-xvcg
- https://nvd.nist.gov/vuln/detail/CVE-2026-42031
- https://docs.ckan.org/en/2.10/changelog.html#v-2-10-10-2026-04-29
- https://docs.ckan.org/en/2.11/changelog.html#v-2-11-5-2026-04-29
- https://docs.ckan.org/en/2.11/extensions/plugin-interfaces.html#ckan.plugins.interfaces.IAuthFunctions
- https://docs.ckan.org/en/2.11/maintaining/configuration.html#ckan-datastore-sqlsearch-enabled
- https://github.com/ckan/ckan
- https://pypi.org/project/ckan
- https://github.com/advisories/GHSA-h7j7-3rx6-xvcg
- Vector CVSS
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N- Debilidad (CWE)
CWE-863, CWE-89- Plataforma
- Python (PyPI)
- Paquete
ckan- Publicada
- 29.04.2026
- Actualizado
- 11.10.2026 14:18
Fuentes y licencias
OSV / GitHub Advisory Database - PYSEC-2026-2417 - PyPA Advisory Database; CC BY 4.0
OSV / GitHub Advisory Database - GHSA-h7j7-3rx6-xvcg - CC BY 4.0
Historial de vulnerabilidades: ckan
Todas las vulnerabilidades publicadas de este paquete (Python (PyPI)), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.
- Entradas en total
- 15
- Primera → última
- 12.2021 04.2026
- Sin corrección
- 0
- Explotada en ataques
- 0
Distribución por gravedad
- Crítica 1
- Alta 3
- Media 11
Divulgaciones por año
- 2021: 1
- 2022: 1
- 2023: 2
- 2024: 4
- 2025: 3
- 2026: 4
-
CKAN has Unauthenticated SQL Injection and Authorization Bypass in `datastore_search_sql` esta entrada
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.