CKAN has CSRF exemption primed by anonymous requests
Views can be marked as exempt from CSRF protection
Access to the views via tokens or unauthenticated requests marked the endpoint as not requiring CSRF protection.
The marking was a member variable in flask-wtf.csrf.CSRFProtect(), which was stored as a module level variable in the flask_app middleware. Thsi API was never intended for request level changes, it is primarily a decorator for static configuration.
An unauthenticated request could hit a protected endpoint, exempting it from CSRF protection for the life of the particular server process. (e.g. one worker of uwsgi).
This could be leveraged with XSS to perform actions using other user's credentials.
References
- Vulnerability report by @Shirshaw64p (original reporter)
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Python (PyPI) | ckan | >= 2.10.0, < 2.10.10, >= 2.11.0, < 2.11.5 | 2.10.10, 2.11.5 |
References
- https://github.com/ckan/ckan/security/advisories/GHSA-mcvf-jxcw-vj73
- https://nvd.nist.gov/vuln/detail/CVE-2026-41255
- https://docs.ckan.org/en/2.10/changelog.html#v-2-10-10-2026-04-29
- https://docs.ckan.org/en/2.11/changelog.html#v-2-11-5-2026-04-29
- https://github.com/Shirshaw64p/security-advisories/tree/main/CVE-2026-41255
- https://github.com/ckan/ckan
- https://pypi.org/project/ckan
- https://github.com/advisories/GHSA-mcvf-jxcw-vj73
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N- Weakness (CWE)
CWE-352- Platform
- Python (PyPI)
- Package
ckan- Disclosed
- 29.04.2026
- Updated
- 11.10.2026 14:18
Sources and licenses
OSV / GitHub Advisory Database - PYSEC-2026-2418 - PyPA Advisory Database; CC BY 4.0
OSV / GitHub Advisory Database - GHSA-mcvf-jxcw-vj73 - CC BY 4.0
Vulnerability history: ckan
All published vulnerabilities of this package (Python (PyPI)), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 15
- First → latest
- 12.2021 04.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- Critical 1
- High 3
- Medium 11
Disclosures per year
- 2021: 1
- 2022: 1
- 2023: 2
- 2024: 4
- 2025: 3
- 2026: 4
-
CKAN has CSRF exemption primed by anonymous requests this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.