CVE-2026-41132 — CKAN: No certificate validation on STMP connection
CKAN is an open-source DMS (data management system) for powering data hubs and data portals. Prior to 2.10.10 and 2.11.5, the configured SMTP server may be spoofed with any cert…
Published: 2026-05-13 · CVSS: 6.6 · CVSS 4.0
CKAN is an open-source DMS (data management system) for powering data hubs and data portals. Prior to 2.10.10 and 2.11.5, the configured SMTP server may be spoofed with any certificate (e.g. self-signed), leaving credentials and all emails sent open to MITM attacks. This vulnerability is fixed in 2.10.10 and 2.11.5.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7