CVE-2026-42031: 
Python vulnerability analysis and mitigation

CVE-2026-42031 is an unauthenticated SQL injection and authorization bypass vulnerability in CKAN's datastore_search_sql function, allowing attackers to inject arbitrary SQL queries to access private resources and PostgreSQL system information. It affects CKAN versions prior to 2.10.10 and versions 2.11.0 through 2.11.4. The vulnerability was disclosed on April 29, 2026, and published to the NVD on May 13, 2026. It carries a CVSS v3.1 base score of 9.8 (Critical) and a CVSS v4.0 base score of 8.3 (High) (GitHub Advisory, CKAN Advisory).

The root cause is improper neutralization of special elements in SQL commands (CWE-89) combined with incorrect authorization (CWE-863) within the datastore_search_sql action function. Although CKAN's DataStore SQL search includes some built-in protections, these are explicitly documented as not designed to prevent all types of abuse, and they fail to adequately sanitize attacker-controlled SQL input. An unauthenticated remote attacker can send crafted network requests to the datastore_search_sql API endpoint — which must be explicitly enabled via ckan.datastore.sqlsearch.enabled = true — to inject arbitrary SQL and bypass authorization checks. The vulnerability was reported by Arvin Shivram of Brutecat Security, and a Nuclei detection template was added to the ProjectDiscovery repository shortly after disclosure (GitHub Advisory, CKAN Advisory).

Successful exploitation allows an unauthenticated attacker to read private DataStore resources that should be access-controlled, and to extract PostgreSQL system information (e.g., database schema, internal metadata). The confidentiality impact is high, with potential for unauthorized data disclosure across all datasets stored in the CKAN DataStore. Integrity impact is limited (low per CVSS v4), and there is no direct availability impact, though extracted database information could facilitate further attacks or lateral movement within the hosting environment (GitHub Advisory).

No public proof-of-concept exploit code has been confirmed, and there is no evidence of active in-the-wild exploitation at this time (GitHub Advisory). However, a Nuclei detection template for this CVE was added to the ProjectDiscovery nuclei-templates repository (v10.4.3 release), indicating automated scanning capability exists. The EPSS score is approximately 11.56–13.78% (94th percentile), reflecting a meaningful probability of exploitation within 30 days. No threat actor attribution or CISA KEV catalog listing has been reported. Exploitation requires the DataStore SQL search feature to be explicitly enabled (it is disabled by default), which limits the exposed attack surface.

1. Reconnaissance: Identify internet-facing CKAN instances running versions prior to 2.10.10 or between 2.11.0 and 2.11.4 using search engines (Shodan, Censys) or by probing the CKAN API version endpoint (/api/3/action/status_show).
2. Check feature availability: Probe the datastore_search_sql endpoint (/api/3/action/datastore_search_sql) with a benign SQL query (e.g., SELECT 1) to determine if the feature is enabled. A valid response confirms the attack surface is present.
3. Inject SQL payload: Craft a malicious SQL query parameter that bypasses the existing input protections, for example by using subqueries or UNION-based injection to access private DataStore tables or PostgreSQL system catalogs (e.g., pg_tables, information_schema).
4. Extract private data: Use the injected SQL to enumerate private datasets, extract sensitive records from restricted resources, or retrieve PostgreSQL system information such as database users, table names, and configuration details.
5. Escalate if possible: Leverage extracted credentials or schema information to attempt further access to the underlying database or connected systems (GitHub Advisory).

• Network: Unusual or high-volume HTTP GET/POST requests to /api/3/action/datastore_search_sql from unauthenticated sources; requests containing SQL keywords (SELECT, UNION, FROM, pg_tables, information_schema) in the sql parameter.
• Logs: CKAN access logs showing repeated calls to datastore_search_sql with complex or unexpected SQL strings; error log entries from PostgreSQL related to malformed or unauthorized queries.
• Application Behavior: Responses returning data from private or restricted DataStore resources to unauthenticated API callers; unexpected access to PostgreSQL system catalog tables in query logs.

Upgrade CKAN to version 2.10.10 or 2.11.5, which contain the official patches for this vulnerability (GitHub Advisory, CKAN Advisory). As an immediate workaround, disable the DataStore SQL search feature by setting ckan.datastore.sqlsearch.enabled = false in the CKAN configuration — note this is the default setting, so only deployments that have explicitly enabled it are at risk. Alternatively, restrict access to the datastore_search_sql action using a custom IAuthFunctions plugin to limit which users can invoke it.

The vulnerability was reported by Arvin Shivram of Brutecat Security and disclosed responsibly through GitHub's security advisory process (CKAN Advisory). A technical write-up was published at infinitsec.net shortly after the NVD publication. The ProjectDiscovery team added a Nuclei detection template in release v10.4.3, reflecting community interest in automated detection. Social media activity was limited, with brief mentions on Bluesky and vulnerability tracking platforms.