Which versions of CKAN are affected by CVE-2026-42031?

CKAN data management systems are vulnerable to an unauthenticated SQL injection attack allowing unauthorized access to private data repositories and system information, directly threatening data…. A patch is available.

Is there a public PoC exploit available for CVE-2026-42031?

Yes, a public proof-of-concept exploit is available for CVE-2026-42031. Prioritise patching immediately. EPSS: 3.1%.

How to fix or mitigate CVE-2026-42031?

Within 24 hours: Identify all CKAN deployments and determine which are running vulnerable versions (any version below 2.10.10 or versions 2.11.0 through 2.11.4). Within 7 days: Apply available vendor patches to update vulnerable CKAN instances to version 2.10.10 or later (avoiding 2.11.0-2.11.4 if currently deployed there) and update dependent PostgreSQL and application components. Within 30 days: Audit DataStore access logs for SQL injection patterns and suspicious queries, validate that private data access controls are properly enforced, implement rate-limiting on the datastore_search_sql endpoint to prevent future exploitation, and conduct a data inventory review to identify any unauthorized disclosure.

CKAN CVE-2026-42031

Q: What is the CVSS score of CVE-2026-42031?

CVE-2026-42031 has a CVSS 4.0 base score of 8.3 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 3.1%.

HIGH

SQL Injection (CWE-89)

2026-04-29 https://github.com/ckan/ckan

GHSA-h7j7-3rx6-xvcg

SQLi PostgreSQL

8.3

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.3 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.5 MEDIUM

Network, unauthenticated (PR:N), but requires the non-default sqlsearch feature enabled so AC:H; high confidentiality read, limited integrity, no availability impact.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jul 24, 2026 - 01:19 vuln.today

Analysis Generated

Jul 24, 2026 - 01:19 vuln.today

CVSS changed

May 13, 2026 - 19:22 NVD

8.3 (HIGH)

CVE Published

Apr 29, 2026 - 23:11 github-advisory

HIGH 8.3

CVE Published

Apr 29, 2026 - 23:11 nvd

HIGH

DescriptionGitHub Advisory

Impact

A vulnerability in datastore_search_sql allowed attackers to inject SQL in order to gain access to private resources and PostgreSQL system information.

Patches

The issue has been patched in CKAN 2.10.10 and CKAN 2.11.5

Workarounds

Disable the DataStore SQL search (ckan.datastore.sqlsearch.enabled = false). Note that the SQL search is disabled by default.

More information

As stated in the documentation, this action function has protections that offer some safety but are not designed to prevent all types of abuse. Depending on the sensitivity of private data in a project's DataStore and the likelihood of abuse of a consuming site, a developer may choose to disable this action function or restrict its use with a IAuthFunctions plugin.

Credits

Reported by Arvin Shivram of Brutecat Security

AnalysisAI

SQL injection in CKAN's datastore_search_sql action allows unauthenticated remote attackers to read private DataStore resources and enumerate PostgreSQL system information by injecting crafted SQL. The flaw affects CKAN versions below 2.10.10 and the 2.11.0-2.11.4 range, and also functions as an authorization bypass since private data protected by CKAN's access controls can be exfiltrated. Publicly available exploit code exists; EPSS rates it in the 87th percentile (3.15%), but it is not listed in CISA KEV and there is no public exploit identified as being actively used in the wild.

Technical ContextAI

CKAN is an open-source data management/portal platform (Python, pip package ckan) widely used by governments and organizations to publish open data catalogs. Its DataStore extension stores tabular resource data in PostgreSQL and exposes a datastore_search_sql action that accepts raw SQL queries against that database. The root cause is CWE-89 (SQL Injection): input-sanitization protections on this action were insufficient, letting an attacker break out of the intended query context to reach private resources and PostgreSQL internal/system catalogs. Per CKAN documentation, datastore_search_sql was always understood to offer only partial safety and is disabled by default via ckan.datastore.sqlsearch.enabled = false.

RemediationAI

Vendor-released patch: upgrade to CKAN 2.10.10 (for 2.10.x deployments) or 2.11.5 (for 2.11.x deployments), both released 2026-04-29 (changelogs: https://docs.ckan.org/en/2.10/changelog.html#v-2-10-10-2026-04-29 and https://docs.ckan.org/en/2.11/changelog.html#v-2-11-5-2026-04-29). If immediate patching is not possible, the primary workaround is to disable the DataStore SQL search by setting ckan.datastore.sqlsearch.enabled = false (this is the default, so most sites are unaffected) - the trade-off is loss of arbitrary SQL query capability for any integrations that rely on it. Where the feature must remain enabled, restrict its use with an IAuthFunctions plugin (https://docs.ckan.org/en/2.11/extensions/plugin-interfaces.html#ckan.plugins.interfaces.IAuthFunctions) to limit which users can invoke datastore_search_sql, accepting the added maintenance overhead of a custom auth extension. See advisory GHSA-h7j7-3rx6-xvcg for full guidance.