id: PYSEC-2026-2417
published: "2026-07-13T15:02:55.439373Z"
modified: "2026-07-13T16:03:42.843095Z"
aliases:
- CVE-2026-42031
- GHSA-h7j7-3rx6-xvcg
summary: CKAN has Unauthenticated SQL Injection and Authorization Bypass in `datastore_search_sql`
details: "### Impact\n\nA vulnerability in `datastore_search_sql` allowed attackers to inject SQL in order to gain access to private resources and PostgreSQL system information.\n\n### Patches\nThe issue has been patched in CKAN 2.10.10 and CKAN 2.11.5\n\n### Workarounds\nDisable the DataStore SQL search (`ckan.datastore.sqlsearch.enabled = false`). Note that the SQL search is disabled by default.\n\n### More information\n\nAs stated in the [documentation](https://docs.ckan.org/en/2.11/maintaining/configuration.html#ckan-datastore-sqlsearch-enabled), this action function has protections that offer some safety but are not designed to prevent all types of abuse. Depending on the sensitivity of private data in a project's DataStore and the likelihood of abuse of a consuming site, a developer may choose to disable this action function or restrict its use with a [`IAuthFunctions`](https://docs.ckan.org/en/2.11/extensions/plugin-interfaces.html#ckan.plugins.interfaces.IAuthFunctions) plugin.\n\n### Credits\n\n* Reported by Arvin Shivram of Brutecat Security"
affected:
- package:
    name: ckan
    ecosystem: PyPI
    purl: pkg:pypi/ckan
  ranges:
  - type: ECOSYSTEM
    events:
    - introduced: "0"
    - fixed: 2.10.10
    - introduced: 2.11.0
    - fixed: 2.11.5
  versions:
  - "0.11"
  - "0.3"
  - "0.4"
  - "0.5"
  - "0.6"
  - "0.7"
  - "0.8"
  - "1.0"
  - "1.1"
  - "1.2"
  - "1.3"
  - 1.3.2
  - 1.3.3
  - "1.4"
  - 1.4.1
  - 1.4.2
  - 1.4.3
  - 1.4.3.1
  - "1.5"
  - 1.5.1
  - "1.6"
  - "1.7"
  - 1.7.1
  - "1.8"
  - "2.0"
  - 2.0.1
  - 2.0.7
  - 2.0.8
  - "2.1"
  - 2.1.1
  - 2.1.5
  - 2.1.6
  - 2.10.0
  - 2.10.1
  - 2.10.3
  - 2.10.4
  - 2.10.5
  - 2.10.6
  - 2.10.7
  - 2.10.8
  - 2.10.9
  - 2.11.0
  - 2.11.1
  - 2.11.2
  - 2.11.3
  - 2.11.4
  - "2.2"
  - 2.2.1
  - 2.2.3
  - 2.2.4
  - "2.3"
  - 2.3.1
  - 2.3.2
  - 2.3.3
  - 2.3.4
  - 2.3.5
  - 2.4.0
  - 2.4.1
  - 2.4.2
  - 2.4.3
  - 2.4.4
  - 2.4.5
  - 2.4.8
  - 2.4.9
  - 2.5.0
  - 2.5.1
  - 2.5.2
  - 2.5.3
  - 2.5.4
  - 2.5.6
  - 2.5.7
  - 2.5.8
  - 2.5.9
  - 2.6.0
  - 2.6.1
  - 2.6.3
  - 2.6.4
  - 2.6.5
  - 2.6.6
  - 2.6.7
  - 2.6.8
  - 2.6.9
  - 2.7.0
  - 2.7.1
  - 2.7.10
  - 2.7.11
  - 2.7.12
  - 2.7.2
  - 2.7.3
  - 2.7.4
  - 2.7.5
  - 2.7.6
  - 2.7.7
  - 2.7.8
  - 2.7.9
  - 2.8.0
  - 2.8.1
  - 2.8.10
  - 2.8.11
  - 2.8.12
  - 2.8.2
  - 2.8.3
  - 2.8.4
  - 2.8.5
  - 2.8.6
  - 2.8.7
  - 2.8.8
  - 2.8.9
  - 2.9.0
  - 2.9.1
  - 2.9.10
  - 2.9.11
  - 2.9.2
  - 2.9.3
  - 2.9.4
  - 2.9.5
  - 2.9.6
  - 2.9.7
  - 2.9.8
  - 2.9.9
references:
- type: WEB
  url: https://github.com/ckan/ckan/security/advisories/GHSA-h7j7-3rx6-xvcg
- type: ADVISORY
  url: https://nvd.nist.gov/vuln/detail/CVE-2026-42031
- type: WEB
  url: "https://docs.ckan.org/en/2.10/changelog.html#v-2-10-10-2026-04-29"
- type: WEB
  url: "https://docs.ckan.org/en/2.11/changelog.html#v-2-11-5-2026-04-29"
- type: WEB
  url: "https://docs.ckan.org/en/2.11/extensions/plugin-interfaces.html#ckan.plugins.interfaces.IAuthFunctions"
- type: WEB
  url: "https://docs.ckan.org/en/2.11/maintaining/configuration.html#ckan-datastore-sqlsearch-enabled"
- type: PACKAGE
  url: https://github.com/ckan/ckan
- type: PACKAGE
  url: https://pypi.org/project/ckan
- type: ADVISORY
  url: https://github.com/advisories/GHSA-h7j7-3rx6-xvcg
severity:
- type: CVSS_V4
  score: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N