GHSA-h7j7-3rx6-xvcg

CKAN has Unauthenticated SQL Injection and Authorization Bypass in `datastore_search_sql`

Source: GitHub Advisory Database (reviewed) High CVE-2026-42031

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	ckan	< 2.10.10	2.10.10
PyPI	ckan	>= 2.11.0, < 2.11.5	2.11.5

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact A vulnerability in `datastore_search_sql` allowed attackers to inject SQL in order to gain access to private resources and PostgreSQL system information. ### Patches The issue has been patched in CKAN 2.10.10 and CKAN 2.11.5 ### Workarounds Disable the DataStore SQL search (`ckan.datastore.sqlsearch.enabled = false`). Note that the SQL search is disabled by default. ### More information As stated in the [documentation](https://docs.ckan.org/en/2.11/maintaining/configuration.html#ckan-datastore-sqlsearch-enabled), this action function has protections that offer some safety but are not designed to prevent all types of abuse. Depending on the sensitivity of private data in a project's DataStore and the likelihood of abuse of a consuming site, a developer may choose to disable this action function or restrict its use with a [`IAuthFunctions`](https://docs.ckan.org/en/2.11/extensions/plugin-interfaces.html#ckan.plugins.interfaces.IAuthFunctions) plugin. ### Credits * Reported by Arvin Shivram of Brutecat Security

References

External links from the advisory. They lead to third-party sites.