CVE-2026-41132CWE-295

CKAN: No certificate validation on STMP connection

Medium · published May 13, 2026

CVSS v4.0
6.6
EPSS
0%
Percentile
11.0
In the wild
Unconfirmed
What it is

CKAN is an open-source DMS (data management system) for powering data hubs and data portals. Prior to 2.10.10 and 2.11.5, the configured SMTP server may be spoofed with any certificate (e.g. self-signed), leaving credentials and all emails sent open to MITM attacks. This vulnerability is fixed in 2.10.10 and 2.11.5.

The record
Technical detail
CVSS v4.0
6.6 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U
EPSS
0.00213 · 11.0th percentile
Weakness
CWE-295 · Improper Certificate Validation
Published
2026-05-13T18:53Z
EPSS history
Timeline
  • 13 MAY 18:53Z
    CKAN: No certificate validation on STMP connection
    cvelistv5