Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.6
CVE-2026-42031: CKAN Datastore Search Allows Access to Private Data
GHSA-h7j7-3rx6-xvcg
CVE-2026-42031
GHSA-h7j7-3rx6-xvcg
PYSEC-2026-2417
Summary
Attackers can access sensitive data and system information if they exploit a vulnerability in CKAN's Datastore Search feature. This issue has been fixed in CKAN versions 2.10.10 and 2.11.5. To protect your data, disable the Datastore SQL search feature in your CKAN configuration or use a security plugin to restrict access.
What to do
- Update ckan to version 2.10.10.
- Update ckan to version 2.11.5.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| pip | – | ckan |
< 2.10.10 >= 2.11.0, <= 2.11.4 Fix: upgrade to 2.10.10
|
| PyPI | – | ckan |
>= 2.11.0, < 2.11.5 Fix: upgrade to 2.11.5
|
| – | okfn | ckan |
< 2.10.10 >= 2.11.0, < 2.11.5 cpe:2.3:a:okfn:ckan:*:*:*:*:*:*:*:* |
Original title
CKAN has Unauthenticated SQL Injection and Authorization Bypass in `datastore_search_sql`
Original description
### Impact
A vulnerability in `datastore_search_sql` allowed attackers to inject SQL in order to gain access to private resources and PostgreSQL system information.
### Patches
The issue has been patched in CKAN 2.10.10 and CKAN 2.11.5
### Workarounds
Disable the DataStore SQL search (`ckan.datastore.sqlsearch.enabled = false`). Note that the SQL search is disabled by default.
### More information
As stated in the [documentation](https://docs.ckan.org/en/2.11/maintaining/configuration.html#ckan-datastore-sqlsearch-enabled), this action function has protections that offer some safety but are not designed to prevent all types of abuse. Depending on the sensitivity of private data in a project's DataStore and the likelihood of abuse of a consuming site, a developer may choose to disable this action function or restrict its use with a [`IAuthFunctions`](https://docs.ckan.org/en/2.11/extensions/plugin-interfaces.html#ckan.plugins.interfaces.IAuthFunctions) plugin.
### Credits
* Reported by Arvin Shivram of Brutecat Security
A vulnerability in `datastore_search_sql` allowed attackers to inject SQL in order to gain access to private resources and PostgreSQL system information.
### Patches
The issue has been patched in CKAN 2.10.10 and CKAN 2.11.5
### Workarounds
Disable the DataStore SQL search (`ckan.datastore.sqlsearch.enabled = false`). Note that the SQL search is disabled by default.
### More information
As stated in the [documentation](https://docs.ckan.org/en/2.11/maintaining/configuration.html#ckan-datastore-sqlsearch-enabled), this action function has protections that offer some safety but are not designed to prevent all types of abuse. Depending on the sensitivity of private data in a project's DataStore and the likelihood of abuse of a consuming site, a developer may choose to disable this action function or restrict its use with a [`IAuthFunctions`](https://docs.ckan.org/en/2.11/extensions/plugin-interfaces.html#ckan.plugins.interfaces.IAuthFunctions) plugin.
### Credits
* Reported by Arvin Shivram of Brutecat Security
ghsa CVSS4.0
8.3
Vulnerability type
CWE-89
SQL Injection
CWE-863
Incorrect Authorization
- https://github.com/ckan/ckan/security/advisories/GHSA-h7j7-3rx6-xvcg
- https://docs.ckan.org/en/2.10/changelog.html#v-2-10-10-2026-04-29
- https://docs.ckan.org/en/2.11/changelog.html#v-2-11-5-2026-04-29
- https://github.com/ckan/ckan Product
- https://docs.ckan.org/en/2.11/extensions/plugin-interfaces.html#ckan.plugins.int...
- https://docs.ckan.org/en/2.11/maintaining/configuration.html#ckan-datastore-sqls...
- https://github.com/advisories/GHSA-h7j7-3rx6-xvcg
- https://nvd.nist.gov/vuln/detail/CVE-2026-42031
- https://pypi.org/project/ckan Product
Published: 13 Jul 2026 · Updated: 17 Jul 2026 · First seen: 29 Apr 2026