# CVE-2026-41132: CKAN improper certificate validation in SMTP connection

Source: https://junglewise.ai/threats/cve-2026-41132-ckan-improper-certificate-validation-in-smtp-connection  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-13. Updated: 2026-05-14  
License: CC BY 4.0 with a link back

CVE-2026-41132 · Severity: medium · CVSS 4 · Published 2026-05-13

CKAN, an open-source data portal platform, fails to validate security certificates when connecting to email (SMTP) servers. This allows an attacker to intercept or spoof communications, potentially exposing sensitive email content and server credentials. Organizations using CKAN for data management and distribution should update to the latest patched versions to ensure their automated email communications remain secure.

Technologies: [CKAN](https://junglewise.ai/threats/technologies/ckan), [ckan (PyPI)](https://junglewise.ai/threats/technologies/pypi-ckan). Vendors: [CKAN](https://junglewise.ai/threats/vendors/ckan), [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-41132 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-41132 being exploited in the wild.

**How severe is CVE-2026-41132?** Medium severity, with a CVSS score of 4, published 13 May 2026.

**Which products and versions are affected?** CKAN < 2.10.10, < 2.11.5; ckan (PyPI) ECOSYSTEM:introduced=0,fixed=2.10.10,introduced=2.11.0,fixed=2.11.5, ECOSYSTEM:introduced=2.11.0,fixed=2.11.5.

**Is there a fix for CVE-2026-41132?** Yes. ckan (PyPI): upgrade to 2.11.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-41132 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-41132?** Check whether you run CKAN or ckan (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- ckan (PyPI): upgrade to 2.11.5 or later

  ```sh
  pip install "ckan>=2.11.5"
  ```


## Technical details

CKAN contains a vulnerability where it fails to perform proper certificate validation (CWE-295) when establishing an SMTP connection. Because the software does not verify the authenticity of the SMTP server's certificate, it will accept any certificate, including self-signed ones. A network-positioned attacker can exploit this by performing a man-in-the-middle (MITM) attack to spoof the configured SMTP server. This allows the attacker to capture plaintext email credentials and intercept all outgoing email traffic. The issue is fixed in CKAN versions 2.10.10 and 2.11.5.

## Affected products

- ckan ckan >= 2.11.0, <= 2.11.4
- ckan ckan < 2.10.10

## Identifiers

- CVE-2026-41132
- GHSA-mpfm-fpgx-647q
- PYSEC-2026-2419

## Timeline

- 2026-04-29: disclosed
- 2026-04-29: patched
- 2026-04-29: advisory

## References

- [https://api.github.com/users/francisbergin](https://api.github.com/users/francisbergin)
- [https://github.com/francisbergin](https://github.com/francisbergin)
- [https://api.github.com/users/francisbergin/gists%7B/gist_id%7D](https://api.github.com/users/francisbergin/gists%7B/gist_id%7D)
- [https://api.github.com/users/francisbergin/repos](https://api.github.com/users/francisbergin/repos)
- [https://avatars.githubusercontent.com/u/198925343?v=4](https://avatars.githubusercontent.com/u/198925343?v=4)
- [https://api.github.com/users/francisbergin/events%7B/privacy%7D](https://api.github.com/users/francisbergin/events%7B/privacy%7D)

## Related threats

- [PYSEC-2026-1250 - CKAN has an XSS vector in user uploaded images in group/org and user profiles](https://junglewise.ai/threats/cve-2025-24372-ckan-has-an-xss-vector-in-user-uploaded-images-in-group-org-and)
- [PYSEC-2026-1252 - Potential access to sensitive URLs via CKAN extensions (SSRF)](https://junglewise.ai/threats/cve-2024-43371-potential-access-to-sensitive-urls-via-ckan-extensions-ssrf)
- [PYSEC-2026-1253 - CKAN has Cross-site Scripting vector in the Datatables view plugin](https://junglewise.ai/threats/cve-2024-41675-ckan-has-cross-site-scripting-vector-in-the-datatables-view)
- [PYSEC-2026-1248 - CKAN may leak Solr credentials via error message in package_search action](https://junglewise.ai/threats/cve-2024-41674-ckan-solr-credentials-leak-in-package-search-error-message)
- [PYSEC-2026-1251 - Potential log injection in reset user endpoint in CKAN](https://junglewise.ai/threats/cve-2024-27097-potential-log-injection-in-reset-user-endpoint-in-ckan)