6.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-42032

CVE-2026-42032: CKAN: Unauthenticated Authorization Bypass in `datastore_search_sql`

CKAN is an open-source DMS (data management system) for powering data hubs and data portals. Prior to 2.10.10 and 2.11.5, a vulnerability in datastore_search_sql allowed attackers to bypass authorization in order to gain access to private resources and PostgreSQL system information This vulnerability is fixed in 2.10.10 and 2.11.5.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-42032

CVE-2026-42032:

6.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
ckan	pip	< 2.10.10	2.10.10
ckan	pip	>= 2.11.0, <= 2.11.4	2.11.5

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is an SQL injection in the datastore_search_sql action in CKAN's datastore extension. The analysis of the commits between the vulnerable version (2.10.9) and the patched version (2.10.10) reveals two key changes that address the vulnerability.

First, commit 4e2cf5b1450494762addb87e41ce26ac2abcf5b2 patches the is_single_statement function in ckanext/datastore/helpers.py. This function is a security control meant to prevent multiple SQL statements from being executed. The patch adds a check to disallow queries containing \', which indicates that this sequence could be used to bypass the single statement check, thus enabling SQL injection. The is_single_statement function is called by datastore_search_sql to validate its input.

Second, commit 13b1e56d64b9dfd3bc5c9a7eb5c22b632f2cc8a7 removes the ts_rewrite function from the list of allowed functions in the datastore. The commit message explicitly states that this function is not safe and can be used for SQL injection.

Based on this, the primary vulnerable function is datastore_search_sql, which is the action that processes the malicious input. The is_single_statement function is also identified as a vulnerable function because it contained the flawed validation logic that was exploited. During an exploit, both of these functions would likely appear in a runtime profile.

Vulnerable functions

is_single_statement

ckanext/datastore/helpers.py

This function is responsible for checking if the input SQL contains only a single statement. The patch adds a check for escaped quotes (`\\'`), which could be used to bypass the check and inject malicious SQL statements. This indicates the previous implementation was vulnerable to SQL injection.

datastore_search_sql

ckanext/datastore/logic/action.py

This is the main CKAN action function that is exposed to users. It takes the user-provided SQL query and is the entry point for the vulnerability. It uses the `is_single_statement` function to validate the input, which was bypassable. The vulnerability allows an attacker to execute arbitrary SQL, bypassing authorization.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.