CVSS 4.0
6.7 mediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:UCVE-2026-42032
Medium (6.7) in okfn ckan. EPSS 0.4% chance of exploitation in the next 30 days. Fixed in ckan 2.10.10, 2.11.5.
CKAN is an open-source DMS (data management system) for powering data hubs and data portals. Prior to 2.10.10 and 2.11.5, a vulnerability in datastore_search_sql allowed attackers to bypass authorization in order to gain access to private resources and PostgreSQL system information This vulnerability is fixed in 2.10.10 and 2.11.5.
Severity
CVSS 3.1
9.1 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N- EPSS
- 0.4% chance of exploitation in the next 30 days; higher than 30% of CVEs (scores of 2026-10-31)
- CWE
- CWE-863
- Published
- Modified
- Record from
- the NVD, synced
Affected
- okfn:ckan
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-cg4x-64p3-x59h | PyPI | ckan | <2.10.10 | 2.10.10 |
| GHSA-cg4x-64p3-x59h | PyPI | ckan | >=2.11.0 <2.11.5 | 2.11.5 |
| PYSEC-2026-2416 | PyPI | ckan | <2.10.10 >=2.11.0 <2.11.5 | 2.10.10, 2.11.5 |