Description
CKAN is an open-source DMS (data management system) for powering data hubs and data portals. Prior to 2.10.10 and 2.11.5, a vulnerability in datastore_search_sql allowed attackers to bypass authorization in order to gain access to private resources and PostgreSQL system information This vulnerability is fixed in 2.10.10 and 2.11.5.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| ckan | ckan | >= 2.11.0, < 2.11.5, < 2.10.10 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | ckan | < 2.10.10 | 2.10.10 | GHSA-cg4x-64p3-x59h |
| PyPI | ckan | >= 2.11.0, < 2.11.5 | 2.11.5 | GHSA-cg4x-64p3-x59h |
| PyPI | ckan | < 2.10.10 · >= 2.11.0, < 2.11.5 | 2.10.10, 2.11.5 | PYSEC-2026-2416 |
Advisories 1
- WID-SEC-2026-1560 CKAN: Mehrere Schwachstellen BSI CERT-Bund (WID) · May 17, 2026