PyPI/ckan CVE-2026-42031: critical 9.8, EPSS 1.82%

CKAN has Unauthenticated SQL Injection and Authorization Bypass in `datastore_search_sql`

Action: Upgrade ckan to 2.10.10 or later.

pip install ckan==2.10.10

pip install ckan==2.11.5

Affected

Fixed versions

Sources

• osv: PYSEC-2026-2417
• nvd: CVE-2026-42031
• https://github.com/ckan/ckan/security/advisories/GHSA-h7j7-3rx6-xvcg
• https://docs.ckan.org/en/2.10/changelog.html#v-2-10-10-2026-04-29
• https://docs.ckan.org/en/2.11/changelog.html#v-2-11-5-2026-04-29
• https://docs.ckan.org/en/2.11/extensions/plugin-interfaces.html#ckan.plugins.interfaces.IAuthFunctions
• https://docs.ckan.org/en/2.11/maintaining/configuration.html#ckan-datastore-sqlsearch-enabled
• https://github.com/ckan/ckan
• https://pypi.org/project/ckan
• https://github.com/advisories/GHSA-h7j7-3rx6-xvcg

CVE-2026-42031 · published 2026-07-13T15:02:55.439373Z · modified 2026-07-13T16:31:32.602029722Z · JSON