Okfn Ckan vulnerabilities

CVE-2026-42031 [CRITICAL] CWE-89 CVE-2026-42031: CKAN is an open-source DMS (data management system) for powering data hubs and data portals. Prior t CKAN is an open-source DMS (data management system) for powering data hubs and data portals. Prior to 2.10.10 and 2.11.5, a vulnerability in datastore_search_sql allowed attackers to inject SQL in order to gain access to private resources and PostgreSQL system information This vulnerability is fixed in 2.10.10 and 2.11.5.

CVE-2023-32321 [CRITICAL] CWE-20 CVE-2023-32321: CKAN is an open-source data management system for powering data hubs and data portals. Multiple vuln CKAN is an open-source data management system for powering data hubs and data portals. Multiple vulnerabilities have been discovered in Ckan which may lead to remote code execution. An arbitrary file write in `resource_create` and `package_update` actions, using the `ResourceUploader` object. Also reachable via `package_create`, `package_revise`, a

CVE-2026-42032 [CRITICAL] CWE-863 CVE-2026-42032: CKAN is an open-source DMS (data management system) for powering data hubs and data portals. Prior t CKAN is an open-source DMS (data management system) for powering data hubs and data portals. Prior to 2.10.10 and 2.11.5, a vulnerability in datastore_search_sql allowed attackers to bypass authorization in order to gain access to private resources and PostgreSQL system information This vulnerability is fixed in 2.10.10 and 2.11.5.

CVE-2023-32696 [HIGH] CWE-269 CVE-2023-32696: CKAN is an open-source data management system for powering data hubs and data portals. Prior to vers CKAN is an open-source data management system for powering data hubs and data portals. Prior to versions 2.9.9 and 2.10.1, the `ckan` user (equivalent to www-data) owned code and configuration files in the docker container and the `ckan` user had the permissions to use sudo. These issues allowed for code execution or privilege escalation if an arbitra

CVE-2022-43685 [HIGH] CWE-862 CVE-2022-43685: CKAN through 2.9.6 account takeovers by unauthenticated users when an existing user id is sent via a CKAN through 2.9.6 account takeovers by unauthenticated users when an existing user id is sent via an HTTP POST request. This allows a user to take over an existing account including superuser accounts.

CVE-2026-41132 [HIGH] CWE-295 CVE-2026-41132: CKAN is an open-source DMS (data management system) for powering data hubs and data portals. Prior t CKAN is an open-source DMS (data management system) for powering data hubs and data portals. Prior to 2.10.10 and 2.11.5, the configured SMTP server may be spoofed with any certificate (e.g. self-signed), leaving credentials and all emails sent open to MITM attacks. This vulnerability is fixed in 2.10.10 and 2.11.5.

CVE-2023-22746 [HIGH] CWE-330 CVE-2023-22746: CKAN is an open-source DMS (data management system) for powering data hubs and data portals. When cr CKAN is an open-source DMS (data management system) for powering data hubs and data portals. When creating a new container based on one of the Docker images listed below, the same secret key was being used by default. If the users didn't set a custom value via environment variables in the `.env` file, that key was shared across different CKAN instance

CVE-2024-43371 [MEDIUM] CWE-918 CVE-2024-43371: CKAN is an open-source data management system for powering data hubs and data portals. There are a n CKAN is an open-source data management system for powering data hubs and data portals. There are a number of CKAN plugins, including XLoader, DataPusher, Resource proxy and ckanext-archiver, that work by downloading the contents of local or remote files in order to perform some actions with their contents (e.g. pushing to the DataStore, streaming co

CVE-2023-50248 [MEDIUM] CWE-130 CVE-2023-50248: CKAN is an open-source data management system for powering data hubs and data portals. Starting in v CKAN is an open-source data management system for powering data hubs and data portals. Starting in version 2.0.0 and prior to versions 2.9.10 and 2.10.3, when submitting a POST request to the `/dataset/new` endpoint (including either the auth cookie or the `Authorization` header) with a specially-crafted field, an attacker can create an out-of-memor

CVE-2026-41255 [MEDIUM] CWE-352 CVE-2026-41255: CKAN is an open-source DMS (data management system) for powering data hubs and data portals. Prior t CKAN is an open-source DMS (data management system) for powering data hubs and data portals. Prior to 2.10.10 and 2.11.5, Access to the views via tokens or unauthenticated requests marked the endpoint as not requiring CSRF protection. The marking was a member variable in flask-wtf.csrf.CSRFProtect(), which was stored as a module level variable in th

CVE-2024-41674 [MEDIUM] CWE-209 CVE-2024-41674: CKAN is an open-source data management system for powering data hubs and data portals. If there were CKAN is an open-source data management system for powering data hubs and data portals. If there were connection issues with the Solr server, the internal Solr URL (potentially including credentials) could be leaked to package_search calls as part of the returned error message. This has been patched in CKAN 2.10.5 and 2.11.0.

CVE-2024-41675 [MEDIUM] CWE-79 CVE-2024-41675: CKAN is an open-source data management system for powering data hubs and data portals. The Datatable CKAN is an open-source data management system for powering data hubs and data portals. The Datatables view plugin did not properly escape record data coming from the DataStore, leading to a potential XSS vector. Sites running CKAN >= 2.7.0 with the datatables_view plugin activated. This is a plugin included in CKAN core, that not activated by default

CVE-2021-25967 [MEDIUM] CWE-79 CVE-2021-25967: In CKAN, versions 2.9.0 to 2.9.3 are affected by a stored XSS vulnerability via SVG file upload of u In CKAN, versions 2.9.0 to 2.9.3 are affected by a stored XSS vulnerability via SVG file upload of users’ profile picture. This allows low privileged application users to store malicious scripts in their profile picture. These scripts are executed in a victim’s browser when they open the malicious profile picture

CVE-2024-27097 [MEDIUM] CWE-532 CVE-2024-27097: A user endpoint didn't perform filtering on an incoming parameter, which was added directly to the a A user endpoint didn't perform filtering on an incoming parameter, which was added directly to the application log. This could lead to an attacker injecting false log entries or corrupt the log file format. This has been fixed in the CKAN versions 2.9.11 and 2.10.4. Users are advised to upgrade. Users unable to upgrade should override the `/user/res