# CVE-2026-42032: CKAN authorization bypass in datastore_search_sql

Source: https://junglewise.ai/threats/cve-2026-42032-ckan-authorization-bypass-in-datastore-search-sql  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-13. Updated: 2026-05-14  
License: CC BY 4.0 with a link back

CVE-2026-42032 · Severity: medium · CVSS 4 · Published 2026-05-13

CKAN is an open-source data portal platform used by governments and organizations to share data. A security flaw in its SQL search feature allows unauthorized users to bypass security checks and access private data or internal database information. This could lead to the exposure of sensitive datasets that were intended to be restricted.

Technologies: [CKAN](https://junglewise.ai/threats/technologies/ckan), [ckan (PyPI)](https://junglewise.ai/threats/technologies/pypi-ckan). Vendors: [CKAN](https://junglewise.ai/threats/vendors/ckan), [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-42032 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-42032 being exploited in the wild.

**How severe is CVE-2026-42032?** Medium severity, with a CVSS score of 4, published 13 May 2026.

**Which products and versions are affected?** CKAN < 2.10.10, >= 2.11.0, <= 2.11.4; ckan (PyPI) ECOSYSTEM:introduced=0,fixed=2.10.10, ECOSYSTEM:introduced=0,fixed=2.10.10,introduced=2.11.0,fixed=2.11.5.

**Is there a fix for CVE-2026-42032?** Yes. ckan (PyPI): upgrade to 2.10.10, 2.11.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-42032 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-42032?** Check whether you run CKAN or ckan (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- ckan (PyPI): upgrade to 2.10.10, 2.11.5 or later

  ```sh
  pip install "ckan>=2.11.5"
  ```


## Technical details

An incorrect authorization vulnerability (CWE-863) exists in CKAN's `datastore_search_sql` action function. When the DataStore SQL search feature is enabled, an unauthenticated remote attacker can bypass intended access controls to query private resources and retrieve PostgreSQL system information. The vulnerability stems from insufficient validation within the SQL search logic. The issue is patched in versions 2.10.10 and 2.11.5. A known workaround is to disable the feature by setting `ckan.datastore.sqlsearch.enabled = false`, which is the default configuration.

## Affected products

- CKAN ckan < 2.10.10, >= 2.11.0, <= 2.11.4

## Identifiers

- CVE-2026-42032
- GHSA-cg4x-64p3-x59h
- PYSEC-2026-2416

## Timeline

- 2026-04-29: patched: Patched in versions 2.10.10 and 2.11.5
- 2026-04-30: advisory: GitHub Advisory published

## References

- [https://api.github.com/users/ddd](https://api.github.com/users/ddd)
- [https://github.com/ddd](https://github.com/ddd)
- [https://api.github.com/users/ddd/gists%7B/gist_id%7D](https://api.github.com/users/ddd/gists%7B/gist_id%7D)
- [https://api.github.com/users/ddd/repos](https://api.github.com/users/ddd/repos)
- [https://avatars.githubusercontent.com/u/133477212?v=4](https://avatars.githubusercontent.com/u/133477212?v=4)
- [https://api.github.com/users/ddd/events%7B/privacy%7D](https://api.github.com/users/ddd/events%7B/privacy%7D)

## Related threats

- [PYSEC-2026-1250 - CKAN has an XSS vector in user uploaded images in group/org and user profiles](https://junglewise.ai/threats/cve-2025-24372-ckan-has-an-xss-vector-in-user-uploaded-images-in-group-org-and)
- [PYSEC-2026-1252 - Potential access to sensitive URLs via CKAN extensions (SSRF)](https://junglewise.ai/threats/cve-2024-43371-potential-access-to-sensitive-urls-via-ckan-extensions-ssrf)
- [PYSEC-2026-1253 - CKAN has Cross-site Scripting vector in the Datatables view plugin](https://junglewise.ai/threats/cve-2024-41675-ckan-has-cross-site-scripting-vector-in-the-datatables-view)
- [PYSEC-2026-1248 - CKAN may leak Solr credentials via error message in package_search action](https://junglewise.ai/threats/cve-2024-41674-ckan-solr-credentials-leak-in-package-search-error-message)
- [PYSEC-2026-1251 - Potential log injection in reset user endpoint in CKAN](https://junglewise.ai/threats/cve-2024-27097-potential-log-injection-in-reset-user-endpoint-in-ckan)