CVE-2026-42031CWE-89

CKAN: Unauthenticated SQL Injection and Authorization Bypass in `datastore_search_sql`

High · published May 13, 2026

CVSS v4.0
8.3
EPSS
2%
Percentile
82.3
In the wild
Unconfirmed
What it is

CKAN is an open-source DMS (data management system) for powering data hubs and data portals. Prior to 2.10.10 and 2.11.5, a vulnerability in datastore_search_sql allowed attackers to inject SQL in order to gain access to private resources and PostgreSQL system information This vulnerability is fixed in 2.10.10 and 2.11.5.

The record
Technical detail
CVSS v4.0
8.3 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS
0.02188 · 82.3th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2026-05-13T18:52Z
EPSS history
Timeline
  • 13 MAY 18:52Z
    CKAN: Unauthenticated SQL Injection and Authorization Bypass in `datastore_search_sql`
    cvelistv5