N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-41132

CVE-2026-41132: CKAN has no certificate validation on STMP connection

Impact

Configured SMTP server may be spoofed with any certificate (e.g. self-signed), leaving credentials and all emails sent open to MITM attacks.

Patches

The vulnerability has been patched in CKAN 2.10.10 and CKAN 2.11.5

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-41132

CVE-2026-41132:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
ckan	pip	>= 2.11.0, <= 2.11.4	2.11.5
ckan	pip	< 2.10.10	2.10.10

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the lack of certificate validation when establishing a secure SMTP connection using STARTTLS. The analysis of the patch commit 4ccd9088e00c659719438781975d087951b093af reveals the exact location of the vulnerability. In the file ckan/lib/mailer.py, the function _mail_recipient was modified. The vulnerable code was the line smtp_connection.starttls(), which was called without any arguments. This usage of the starttls method from Python's smtplib does not perform any certificate validation. The patch introduces logic to create a proper SSL context using ssl.create_default_context(), which enforces certificate validation by default, and then passes this context to the starttls method. This ensures that the SMTP server's certificate is verified, mitigating the Man-in-the-Middle (MITM) risk. The function _mail_recipient is the direct runtime indicator of this vulnerability being triggered.

Vulnerable functions

_mail_recipient

ckan/lib/mailer.py

The function `_mail_recipient` is responsible for sending emails. When configured to use STARTTLS, it calls `smtp_connection.starttls()`. Before the patch, this call was made without an SSL context, which means the SMTP server's certificate was not being validated. This allows a man-in-the-middle attacker to intercept the connection by presenting an arbitrary certificate.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.