CKAN CVE-2026-41132

Upgrade CKAN to version 2.10.10 or later (if on the 2.10 branch) or to version 2.11.5 or later (if on the 2.11 branch). These patched versions implement proper SMTP certificate validation, preventing spoofing attacks. The upgrade process is documented in the CKAN changelog at https://docs.ckan.org/en/2.10/changelog.html#v-2-10-10-2026-04-29. For organizations unable to patch immediately, compensating controls include: (1) restricting network access to the SMTP server using firewall rules or network segmentation to trusted hosts only-this eliminates the network adjacency required for a MITM attack but requires careful network architecture; (2) configuring CKAN to use an SMTP server on localhost or a directly-connected, hardened mail relay to minimize the attack surface, though this may not be feasible in all deployments; (3) monitoring SMTP connections for unexpected certificates or connection attempts, though this is reactive rather than preventive. None of these workarounds are as effective as applying the patch, which is the recommended primary action.