Executive brief
CKAN, an open-source data portal platform, contains a vulnerability in its DataStore search functionality. An unauthenticated attacker can exploit this to bypass security restrictions and gain unauthorized access to private data and internal database system information. This could lead to the exposure of sensitive datasets and compromise the integrity of the data management system.
Technical details
A vulnerability exists in the `datastore_search_sql` action function of CKAN due to improper neutralization of special elements in SQL commands (CWE-89) and incorrect authorization (CWE-863). An unauthenticated remote attacker can execute arbitrary SQL queries via the DataStore API to bypass access controls and retrieve private resources or PostgreSQL system metadata. The vulnerability is present when the `ckan.datastore.sqlsearch.enabled` configuration is set to true (it is disabled by default). The issue has been addressed in versions 2.10.10 and 2.11.5. As a workaround, administrators can disable the DataStore SQL search feature.
Affected products
- CKAN ckan < 2.10.10, >= 2.11.0, <= 2.11.4
Timeline
- 2026-04-29: disclosed
- 2026-04-29: patched
- 2026-04-29: advisory