CVE-2026-42032: CKAN authorization bypass in datastore_search_sql

Executive brief

CKAN is an open-source data portal platform used by governments and organizations to share data. A security flaw in its SQL search feature allows unauthorized users to bypass security checks and access private data or internal database information. This could lead to the exposure of sensitive datasets that were intended to be restricted.

Technical details

An incorrect authorization vulnerability (CWE-863) exists in CKAN's `datastore_search_sql` action function. When the DataStore SQL search feature is enabled, an unauthenticated remote attacker can bypass intended access controls to query private resources and retrieve PostgreSQL system information. The vulnerability stems from insufficient validation within the SQL search logic. The issue is patched in versions 2.10.10 and 2.11.5. A known workaround is to disable the feature by setting `ckan.datastore.sqlsearch.enabled = false`, which is the default configuration.

Affected products

• CKAN ckan < 2.10.10, >= 2.11.0, <= 2.11.4

Timeline

• 2026-04-29: patched: Patched in versions 2.10.10 and 2.11.5
• 2026-04-30: advisory: GitHub Advisory published

References

• https://api.github.com/users/ddd
• https://github.com/ddd
• https://api.github.com/users/ddd/gists%7B/gist_id%7D
• https://api.github.com/users/ddd/repos
• https://avatars.githubusercontent.com/u/133477212?v=4
• https://api.github.com/users/ddd/events%7B/privacy%7D