PYSEC-2026-2417 CKAN has Unauthenticated SQL Injection and Authorization Bypass in `datastore_search_sql`

🗓️ 13 Jul 2026 15:02:55Reported by GoogleType

osv🔗 osv.dev👁 3 Views

Impact A vulnerability in datastore_search_sql allowed attackers to inject SQL in order to gain access to private resources and PostgreSQL system information. Patches The issue has been patched in CKAN 2.10.10 and CKAN 2.11.5 Workarounds Disable t...

Reporter	Title	Published	Views	Family All 16
ATTACKERKB	CVE-2026-42031	13 May 202618:52	–	attackerkb
Circl	CVE-2026-42031	4 May 202605:43	–	circl
CNNVD	CKAN SQL注入漏洞	13 May 202600:00	–	cnnvd
CVE	CVE-2026-42031	13 May 202618:52	–	cve
Cvelist	CVE-2026-42031 CKAN: Unauthenticated SQL Injection and Authorization Bypass in `datastore_search_sql`	13 May 202618:52	–	cvelist
Github Security Blog	CKAN has Unauthenticated SQL Injection and Authorization Bypass in `datastore_search_sql`	29 Apr 202623:11	–	github
Nuclei	CKAN DataStore SQL Search - SQL Injection	13 Jul 202604:38	–	nuclei
NVD	CVE-2026-42031	13 May 202619:17	–	nvd
OSV	CVE-2026-42031 CKAN: Unauthenticated SQL Injection and Authorization Bypass in `datastore_search_sql`	13 May 202618:52	–	osv
OSV	GHSA-H7J7-3RX6-XVCG CKAN has Unauthenticated SQL Injection and Authorization Bypass in `datastore_search_sql`	29 Apr 202623:11	–	osv

Source	Link
github	www.github.com/ckan/ckan/security/advisories/GHSA-h7j7-3rx6-xvcg
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-42031
docs	www.docs.ckan.org/en/2.10/changelog.html
docs	www.docs.ckan.org/en/2.11/changelog.html
docs	www.docs.ckan.org/en/2.11/extensions/plugin-interfaces.html
docs	www.docs.ckan.org/en/2.11/maintaining/configuration.html
github	www.github.com/ckan/ckan
pypi	www.pypi.org/project/ckan
github	www.github.com/advisories/GHSA-h7j7-3rx6-xvcg

13 Jul 2026 16:31Current

6.1Medium risk

Vulners AI Score6.1

CVSS 48.3

EPSS0.01815