id: PYSEC-2026-2419
published: "2026-07-13T15:02:54.975291Z"
modified: "2026-07-13T16:03:43.001852Z"
aliases:
- CVE-2026-41132
- GHSA-mpfm-fpgx-647q
summary: CKAN has no certificate validation on STMP connection
details: "### Impact\nConfigured SMTP server may be spoofed with any certificate (e.g. self-signed), leaving credentials and all emails sent open to MITM attacks.\n\n### Patches\nThe vulnerability has been patched in CKAN 2.10.10 and CKAN 2.11.5"
affected:
- package:
    name: ckan
    ecosystem: PyPI
    purl: pkg:pypi/ckan
  ranges:
  - type: ECOSYSTEM
    events:
    - introduced: "0"
    - fixed: 2.10.10
    - introduced: 2.11.0
    - fixed: 2.11.5
  versions:
  - "0.11"
  - "0.3"
  - "0.4"
  - "0.5"
  - "0.6"
  - "0.7"
  - "0.8"
  - "1.0"
  - "1.1"
  - "1.2"
  - "1.3"
  - 1.3.2
  - 1.3.3
  - "1.4"
  - 1.4.1
  - 1.4.2
  - 1.4.3
  - 1.4.3.1
  - "1.5"
  - 1.5.1
  - "1.6"
  - "1.7"
  - 1.7.1
  - "1.8"
  - "2.0"
  - 2.0.1
  - 2.0.7
  - 2.0.8
  - "2.1"
  - 2.1.1
  - 2.1.5
  - 2.1.6
  - 2.10.0
  - 2.10.1
  - 2.10.3
  - 2.10.4
  - 2.10.5
  - 2.10.6
  - 2.10.7
  - 2.10.8
  - 2.10.9
  - 2.11.0
  - 2.11.1
  - 2.11.2
  - 2.11.3
  - 2.11.4
  - "2.2"
  - 2.2.1
  - 2.2.3
  - 2.2.4
  - "2.3"
  - 2.3.1
  - 2.3.2
  - 2.3.3
  - 2.3.4
  - 2.3.5
  - 2.4.0
  - 2.4.1
  - 2.4.2
  - 2.4.3
  - 2.4.4
  - 2.4.5
  - 2.4.8
  - 2.4.9
  - 2.5.0
  - 2.5.1
  - 2.5.2
  - 2.5.3
  - 2.5.4
  - 2.5.6
  - 2.5.7
  - 2.5.8
  - 2.5.9
  - 2.6.0
  - 2.6.1
  - 2.6.3
  - 2.6.4
  - 2.6.5
  - 2.6.6
  - 2.6.7
  - 2.6.8
  - 2.6.9
  - 2.7.0
  - 2.7.1
  - 2.7.10
  - 2.7.11
  - 2.7.12
  - 2.7.2
  - 2.7.3
  - 2.7.4
  - 2.7.5
  - 2.7.6
  - 2.7.7
  - 2.7.8
  - 2.7.9
  - 2.8.0
  - 2.8.1
  - 2.8.10
  - 2.8.11
  - 2.8.12
  - 2.8.2
  - 2.8.3
  - 2.8.4
  - 2.8.5
  - 2.8.6
  - 2.8.7
  - 2.8.8
  - 2.8.9
  - 2.9.0
  - 2.9.1
  - 2.9.10
  - 2.9.11
  - 2.9.2
  - 2.9.3
  - 2.9.4
  - 2.9.5
  - 2.9.6
  - 2.9.7
  - 2.9.8
  - 2.9.9
references:
- type: WEB
  url: https://github.com/ckan/ckan/security/advisories/GHSA-mpfm-fpgx-647q
- type: ADVISORY
  url: https://nvd.nist.gov/vuln/detail/CVE-2026-41132
- type: WEB
  url: "https://docs.ckan.org/en/2.10/changelog.html#v-2-10-10-2026-04-29"
- type: WEB
  url: "https://docs.ckan.org/en/2.11/changelog.html#v-2-11-5-2026-04-29"
- type: PACKAGE
  url: https://github.com/ckan/ckan
- type: PACKAGE
  url: https://pypi.org/project/ckan
- type: ADVISORY
  url: https://github.com/advisories/GHSA-mpfm-fpgx-647q
severity:
- type: CVSS_V4
  score: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U