SQL Injection Vulnerability in CKAN Data Management System
CVE-2026-42031

8.3HIGH

Key Information:

Vendor

Ckan

Status
Ckan
Vendor
CVE Published:
13 May 2026

What is CVE-2026-42031?

A SQL injection vulnerability exists in the CKAN data management system within the datastore_search_sql function, affecting versions prior to 2.10.10 and 2.11.5. This flaw allows an attacker to manipulate SQL queries, potentially resulting in unauthorized access to private resources and sensitive PostgreSQL system information. Users are advised to update to the latest versions to safeguard against this security risk.

Affected Version(s)

ckan >= 2.11.0, < 2.11.5 < 2.11.0, 2.11.5

ckan < 2.10.10 < 2.10.10

References

https://github.com/ckan/ckan/security/advisories/GHSA-h7j...
x_refsource_CONFIRM

CVSS V4

Score:
8.3
Severity:
HIGH
Confidentiality:
High
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.