8.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-42031

CVE-2026-42031: CKAN: Unauthenticated SQL Injection and Authorization Bypass in `datastore_search_sql`

CKAN is an open-source DMS (data management system) for powering data hubs and data portals. Prior to 2.10.10 and 2.11.5, a vulnerability in datastore_search_sql allowed attackers to inject SQL in order to gain access to private resources and PostgreSQL system information This vulnerability is fixed in 2.10.10 and 2.11.5.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-42031

CVE-2026-42031:

8.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
ckan	pip	< 2.10.10	2.10.10
ckan	pip	>= 2.11.0, <= 2.11.4	2.11.5

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a SQL injection in the datastore_search_sql action of CKAN's DataStore extension. The root cause is twofold. First, the is_single_statement function, which was supposed to prevent multiple SQL statements from being executed, could be bypassed. The sqlparse library used in this function handles escaped quotes differently than PostgreSQL, allowing an attacker to craft an input that sqlparse sees as a single statement but PostgreSQL interprets as multiple statements. The patch addresses this by explicitly checking for the problematic escape sequence (\') in the input SQL. Second, a dangerous PostgreSQL function ts_rewrite was allowed to be used in the SQL queries. This function could be abused to execute arbitrary SQL. The patch removed ts_rewrite from the list of allowed functions. The primary vulnerable function is datastore_search_sql as it's the user-facing action that accepts the malicious input. The is_single_statement function is also identified as vulnerable as it's the security control that failed to protect against the injection.

Vulnerable functions

datastore_search_sql

ckanext/datastore/logic/action.py

This function is the main entry point for the vulnerability. It takes a user-provided SQL string and executes it. The vulnerability lies in the fact that this function relied on the `is_single_statement` helper function to prevent multiple SQL statements, which was flawed and could be bypassed. This allowed attackers to inject malicious SQL and perform unauthorized actions.

is_single_statement

ckanext/datastore/helpers.py

This helper function was designed as a security measure to ensure that only a single SQL statement is executed. However, it failed to properly handle escaped quotes (`\'`), which allowed attackers to bypass the check and inject additional SQL statements. The patch added a specific check for this sequence to prevent the bypass.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.