CVE-2026-42031 — CKAN: Unauthenticated SQL Injection and Authorization Bypass in `datastore_search_sql`

CVE-2026-42031

CKAN: Unauthenticated SQL Injection and Authorization Bypass in `datastore_search_sql` PUBLISHED

Description (CNA)

CKAN is an open-source DMS (data management system) for powering data hubs and data portals. Prior to 2.10.10 and 2.11.5, a vulnerability in datastore_search_sql allowed attackers to inject SQL in order to gain access to private resources and PostgreSQL system information This vulnerability is fixed in 2.10.10 and 2.11.5.

Affected (CNA)

Vendor / product	Versions
ckan / ckan	affected >= 2.11.0, < 2.11.5; affected < 2.10.10

CWE

CWE-89

References

https://github.com/ckan/ckan/security/advisories/GHSA-h7j7-3rx6-xvcg

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.