CVE-2026-41132 — CKAN: No certificate validation on STMP connection

CVE-2026-41132

CKAN: No certificate validation on STMP connection PUBLISHED

Description (CNA)

CKAN is an open-source DMS (data management system) for powering data hubs and data portals. Prior to 2.10.10 and 2.11.5, the configured SMTP server may be spoofed with any certificate (e.g. self-signed), leaving credentials and all emails sent open to MITM attacks. This vulnerability is fixed in 2.10.10 and 2.11.5.

Affected (CNA)

Vendor / product	Versions
ckan / ckan	affected >= 2.11.0, < 2.11.5; affected < 2.10.10

CWE

CWE-295

References

https://github.com/ckan/ckan/security/advisories/GHSA-mpfm-fpgx-647q

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.