CVE-2026-42031 — CKAN: Unauthenticated SQL Injection and Authorization Bypass in `datastore_search_sql`
CKAN is an open-source DMS (data management system) for powering data hubs and data portals. Prior to 2.10.10 and 2.11.5, a vulnerability in datastore_search_sql allowed attacke…
Published: 2026-05-13 · CVSS: 8.3 · CVSS 4.0
CKAN is an open-source DMS (data management system) for powering data hubs and data portals. Prior to 2.10.10 and 2.11.5, a vulnerability in datastore_search_sql allowed attackers to inject SQL in order to gain access to private resources and PostgreSQL system information This vulnerability is fixed in 2.10.10 and 2.11.5.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7