Description
CKAN is an open-source DMS (data management system) for powering data hubs and data portals. Prior to 2.10.10 and 2.11.5, the configured SMTP server may be spoofed with any certificate (e.g. self-signed), leaving credentials and all emails sent open to MITM attacks. This vulnerability is fixed in 2.10.10 and 2.11.5.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| ckan | ckan | >= 2.11.0, < 2.11.5, < 2.10.10 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | ckan | >= 2.11.0, < 2.11.5 | 2.11.5 | GHSA-mpfm-fpgx-647q |
| PyPI | ckan | < 2.10.10 | 2.10.10 | GHSA-mpfm-fpgx-647q |
| PyPI | ckan | < 2.10.10 · >= 2.11.0, < 2.11.5 | 2.10.10, 2.11.5 | PYSEC-2026-2419 |
Advisories 1
- WID-SEC-2026-1560 CKAN: Mehrere Schwachstellen BSI CERT-Bund (WID) · May 17, 2026