PyPI/ckan CVE-2026-42032: critical 9.1, EPSS 0.37%

CKAN has Unauthenticated Authorization Bypass in `datastore_search_sql`

Action: Upgrade ckan to 2.10.10 or later.

pip install ckan==2.10.10

pip install ckan==2.11.5

Affected

Fixed versions

Sources

• osv: GHSA-cg4x-64p3-x59h
• nvd: CVE-2026-42032
• https://github.com/ckan/ckan/security/advisories/GHSA-cg4x-64p3-x59h
• https://docs.ckan.org/en/2.10/changelog.html#v-2-10-10-2026-04-29
• https://docs.ckan.org/en/2.11/changelog.html#v-2-11-5-2026-04-29
• https://docs.ckan.org/en/2.11/extensions/plugin-interfaces.html#ckan.plugins.interfaces.IAuthFunctions
• https://docs.ckan.org/en/2.11/maintaining/configuration.html#ckan-datastore-sqlsearch-enabled
• https://github.com/ckan/ckan

CVE-2026-42032 · published 2026-04-30T17:34:44Z · modified 2026-07-13T16:42:36.866374300Z · JSON