CKAN has Unauthenticated SQL Injection and Authorization Bypass in `datastore_search_sql`
Impact
A vulnerability in datastore_search_sql allowed attackers to inject SQL in order to gain access to private resources and PostgreSQL system information.
Patches
The issue has been patched in CKAN 2.10.10 and CKAN 2.11.5
Workarounds
Disable the DataStore SQL search (ckan.datastore.sqlsearch.enabled = false). Note that the SQL search is disabled by default.
More information
As stated in the documentation, this action function has protections that offer some safety but are not designed to prevent all types of abuse. Depending on the sensitivity of private data in a project's DataStore and the likelihood of abuse of a consuming site, a developer may choose to disable this action function or restrict its use with a IAuthFunctions plugin.
Credits
- Reported by Arvin Shivram of Brutecat Security
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Python (PyPI) | ckan | < 2.10.10, >= 2.11.0, < 2.11.5 | 2.10.10, 2.11.5 |
References
- https://github.com/ckan/ckan/security/advisories/GHSA-h7j7-3rx6-xvcg
- https://nvd.nist.gov/vuln/detail/CVE-2026-42031
- https://docs.ckan.org/en/2.10/changelog.html#v-2-10-10-2026-04-29
- https://docs.ckan.org/en/2.11/changelog.html#v-2-11-5-2026-04-29
- https://docs.ckan.org/en/2.11/extensions/plugin-interfaces.html#ckan.plugins.interfaces.IAuthFunctions
- https://docs.ckan.org/en/2.11/maintaining/configuration.html#ckan-datastore-sqlsearch-enabled
- https://github.com/ckan/ckan
- https://pypi.org/project/ckan
- https://github.com/advisories/GHSA-h7j7-3rx6-xvcg
- CVSS vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N- Weakness (CWE)
CWE-863, CWE-89- Platform
- Python (PyPI)
- Package
ckan- Disclosed
- 29.04.2026
- Updated
- 11.10.2026 14:18
Sources and licenses
OSV / GitHub Advisory Database - PYSEC-2026-2417 - PyPA Advisory Database; CC BY 4.0
OSV / GitHub Advisory Database - GHSA-h7j7-3rx6-xvcg - CC BY 4.0
Vulnerability history: ckan
All published vulnerabilities of this package (Python (PyPI)), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 15
- First → latest
- 12.2021 04.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- Critical 1
- High 3
- Medium 11
Disclosures per year
- 2021: 1
- 2022: 1
- 2023: 2
- 2024: 4
- 2025: 3
- 2026: 4
-
CKAN has Unauthenticated SQL Injection and Authorization Bypass in `datastore_search_sql` this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.