# CVE-2026-42031: ckan — Fixed in 2.10.10 🐍 PyPI Not in CISA KEV # CVE-2026-42031 — ckan CVE-2026-42031 is a SQL Injection vulnerability in ckan. A fix is available for ckan — see the affected versions and patch details below. CKAN: Unauthenticated SQL Injection and Authorization Bypass in \`datastore\_search\_sql\` Also known as[GHSA-h7j7-3rx6-xvcg](/vulnerability/GHSA-h7j7-3rx6-xvcg)PYSEC-2026-2417 Published May 13, 2026 Updated Oct 28, 2026 Affected 2 pkgs Patched 2 / 2 Exploits None indexed Exploitation data as of Oct 30, 2026 · OSV.dev, NVD, FIRST.org (EPSS) ## Exploitation Status ### No confirmed exploitation observed yet - CISA assesses this as automatable — exploitation doesn’t require manual, per-target effort, which raises the odds of mass scanning and opportunistic attacks. - A successful exploit gives an attacker total control of the affected component, not partial access. - CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment. Exploitation and automatability from CISA’s SSVC triage for CVE-2026-42031. ## EPSS Exploitation Probability [via FIRST.org ↗](https://www.first.org/epss/) 1.8%probability of exploitation in next 30 days Lower Risk\-0.37% Lower risk than most CVEs79th percentile — riskier than 79% of all scored CVEsHighest risk 0.00%5.79%11.6%17.4%13.8%1.8%Jun 26Sep 26Oct 26 Probability of exploitation in the next 30 days, from [FIRST.org EPSS](https://www.first.org/epss/). ## Real-World Exposure 2 pkgs affected 🐍`ckan`🐍`ckan` Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects PyPI packages — download data is not available via public APIs for these ecosystems. ## Description #### Impact A vulnerability in `datastore_search_sql` allowed attackers to inject SQL in order to gain access to private resources and PostgreSQL system information. #### Patches The issue has been patched in CKAN 2.10.10 and CKAN 2.11.5 #### Workarounds Disable the DataStore SQL search (`ckan.datastore.sqlsearch.enabled = false`). Note that the SQL search is disabled by default. #### More information As stated in the [documentation](https://docs.ckan.org/en/2.11/maintaining/configuration.html#ckan-datastore-sqlsearch-enabled), this action function has protections that offer some safety but are not designed to prevent all types of abuse. Depending on the sensitivity of private data in a project's DataStore and the likelihood of abuse of a consuming site, a developer may choose to disable this action function or restrict its use with a [`IAuthFunctions`](https://docs.ckan.org/en/2.11/extensions/plugin-interfaces.html#ckan.plugins.interfaces.IAuthFunctions) plugin. #### Credits - Reported by Arvin Shivram of Brutecat Security ## Affected Packages 2 total 2 fixed Ecosystem Package Vulnerable range Fix 🐍PyPI `ckan` all versions 2.10.10`pip install --upgrade 'ckan==2.10.10'` 🐍PyPI `ckan` ≥ 2.11.0&&< 2.11.5 2.11.5`pip install --upgrade 'ckan==2.11.5'` ## Affected Products 1 product · 2 configurations Application `ckan`okfn ≥ 2.11.0 && < 2.11.5 range ## Detection & mitigation playbook Open-source dependency 1. ### Detect Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for ckan, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version. 2. ### Fix Update ckan to 2.10.10 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-42031 is resolved across your whole dependency graph. 3. ### Workarounds Until you can upgrade, make sure every query built from user input uses parameterised statements or a prepared-statement API rather than string concatenation, and reduce the database account's privileges so an injected query cannot read or alter data beyond what the feature needs. ## How to detect CVE-2026-42031 A community-maintained Nuclei template exists for this CVE. You can scan for it directly: `nuclei -id cve-2026-42031 -u https://target` Template CKAN DataStore SQL Search - SQL Injection Severity high Impact An unauthenticated attacker can read arbitrary data from the PostgreSQL database including system catalog tables, private DataStore resources, and potentially user credentials. Remediation Upgrade CKAN to version 2.10.10 or 2.11.5 or later. Template by [ProjectDiscovery nuclei-templates](https://github.com/projectdiscovery/nuclei-templates) (theamanrawat), MIT licensed. [View the full template](https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-42031.yaml). Scan only systems you are authorised to test. ## Frequently Asked Questions \### Impact A vulnerability in \`datastore\_search\_sql\` allowed attackers to inject SQL in order to gain access to private resources and PostgreSQL system information. ### Patches The issue has been patched in CKAN 2.10.10 and CKAN 2.11.5 ### Workarounds Disable the DataStore SQL search (\`ckan.datastore.sqlsearch.enabled = false\`). Note that the SQL search is disabled by default. ### More information As stated in the \[documentation\](https://docs.ckan.org/en/2.11/maintaining/configuration.html#ckan-datastore-sqlsearch-enabled), this action function has protections that offer some safety but a O3 Security · Impact-Aware SCA ### Is CVE-2026-42031 in your dependencies? Find it across PyPI, including transitive dependencies. [Scan my dependencies](/book-demo) [How O3 SCA works](/impact-aware-sca)