CVSS 4.0
6.6 mediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:UCVE-2026-41132
Medium (6.6) in okfn ckan. EPSS 0.2% chance of exploitation in the next 30 days. Fixed in ckan 2.10.10, 2.11.5.
CKAN is an open-source DMS (data management system) for powering data hubs and data portals. Prior to 2.10.10 and 2.11.5, the configured SMTP server may be spoofed with any certificate (e.g. self-signed), leaving credentials and all emails sent open to MITM attacks. This vulnerability is fixed in 2.10.10 and 2.11.5.
Severity
CVSS 3.1
7.4 highCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N- EPSS
- 0.2% chance of exploitation in the next 30 days; higher than 9% of CVEs (scores of 2026-10-31)
- CWE
- CWE-295
- Published
- Modified
- Record from
- the NVD, synced
Affected
- okfn:ckan
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-mpfm-fpgx-647q | PyPI | ckan | >=2.11.0 <2.11.5 | 2.11.5 |
| GHSA-mpfm-fpgx-647q | PyPI | ckan | <2.10.10 | 2.10.10 |
| PYSEC-2026-2419 | PyPI | ckan | <2.10.10 >=2.11.0 <2.11.5 | 2.10.10, 2.11.5 |