# ckan (PyPI) vulnerabilities 15 known vulnerabilities (1 critical, 3 high, 11 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 2.12.1 (Oct 28, 2026): no advisory affects it - Newest unaffected release: 2.12.1 (Oct 28, 2026), the latest release - Weekly downloads: 2,671 - Dependents: 33 - Releases: 126 since 0.3.0 (Apr 12, 2007) - Registry: https://pypi.org/project/ckan/ - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-42032: 0.3.0 to 2.10.9 (2.10.10 is outside it); 2.11.0 to 2.11.4 (2.11.5 is outside it) - CVE-2026-41255: 2.10.0 to 2.10.9 (2.10.10 is outside it); 2.11.0 to 2.11.4 (2.11.5 is outside it) - CVE-2026-41132: 0.3.0 to 2.10.9 (2.10.10 is outside it); 2.11.0 to 2.11.4 (2.11.5 is outside it) - CVE-2026-42031: 0.3.0 to 2.10.9 (2.10.10 is outside it); 2.11.0 to 2.11.4 (2.11.5 is outside it) - CVE-2025-64100: 2.10.0 to 2.10.8 (2.10.9 is outside it); 2.11.0 to 2.11.3 (2.11.4 is outside it) - CVE-2025-54384: 0.3.0 to 2.10.8 (2.10.9 is outside it); 2.11.0 to 2.11.3 (2.11.4 is outside it) - CVE-2025-24372: 0.3.0 to 2.10.6 (2.10.7 is outside it); 2.11.0 to 2.11.1 (2.11.2 is outside it) - CVE-2024-43371: 0.3.0 to 2.10.4 (2.10.5 is outside it) - CVE-2024-41675: 2.7.0 to 2.10.4 (2.10.5 is outside it) - CVE-2024-41674: 2.0.0 to 2.10.4 (2.10.5 is outside it) - CVE-2024-27097: 0.3.0 to 2.9.10 (2.9.11 is outside it); 2.10.0 to 2.10.3 (2.10.4 is outside it) - CVE-2023-50248: 2.0.0 to 2.9.9 (2.9.10 is outside it); 2.10.0 to 2.10.1 (2.10.3 is outside it) - CVE-2023-32321: 0.3.0 to 2.9.8 (2.9.9 is outside it); 2.10.0 (2.10.1 is outside it) - CVE-2022-43685: 0.3.0 to 2.9.6 (2.9.7 is outside it) - CVE-2021-25967: 2.9.0 to 2.9.11 (2.10.0 is outside it) ## Advisories (15) ### [CVE-2026-42032](https://cve.now/CVE-2026-42032): CKAN: Unauthenticated Authorization Bypass in \`datastore\_search\_sql\` - Severity: Medium 6.7 - Published: May 13, 2026 - Affected: fixed in 2.10.10; from 2.11.0, fixed in 2.11.5; fixed in 2.10.10; from 2.11.0, fixed in 2.11.5. - Fixed in 2.10.10 (released Apr 29, 2026, 14 days before disclosure) and 2.11.5 (released Apr 29, 2026, 14 days before disclosure). - The latest release, 2.12.1, is not affected. ### [CVE-2026-41255](https://cve.now/CVE-2026-41255): CKAN: CSRF exemption primed by anonymous requests - Severity: Medium 6.1 - Published: May 13, 2026 - Affected: from 2.10.0, fixed in 2.10.10; from 2.11.0, fixed in 2.11.5; from 2.10.0, fixed in 2.10.10; from 2.11.0, fixed in 2.11.5. - Fixed in 2.10.10 (released Apr 29, 2026, 14 days before disclosure) and 2.11.5 (released Apr 29, 2026, 14 days before disclosure). - The latest release, 2.12.1, is not affected. ### [CVE-2026-41132](https://cve.now/CVE-2026-41132): CKAN: No certificate validation on STMP connection - Severity: Medium 6.6 - Published: May 13, 2026 - Affected: fixed in 2.10.10; from 2.11.0, fixed in 2.11.5; from 2.11.0, fixed in 2.11.5; fixed in 2.10.10. - Fixed in 2.10.10 (released Apr 29, 2026, 14 days before disclosure) and 2.11.5 (released Apr 29, 2026, 14 days before disclosure). - The latest release, 2.12.1, is not affected. ### [CVE-2026-42031](https://cve.now/CVE-2026-42031): CKAN: Unauthenticated SQL Injection and Authorization Bypass in \`datastore\_search\_sql\` - Severity: High 8.3 - Published: May 13, 2026 - Affected: fixed in 2.10.10; from 2.11.0, fixed in 2.11.5; fixed in 2.10.10; from 2.11.0, fixed in 2.11.5. - Fixed in 2.10.10 (released Apr 29, 2026, 14 days before disclosure) and 2.11.5 (released Apr 29, 2026, 14 days before disclosure). - The latest release, 2.12.1, is not affected. ### [CVE-2025-64100](https://cve.now/CVE-2025-64100): CKAN Vulnerable to Session Cookie Fixation - Severity: Medium 6.1 - Published: Oct 29, 2025 - Affected: from 2.10.0, fixed in 2.10.9; from 2.11.0, fixed in 2.11.4; from 2.10.0, fixed in 2.10.9; from 2.11.0, fixed in 2.11.4. - Fixed in 2.10.9 (released Oct 29, 2025, the day of disclosure) and 2.11.4 (released Oct 29, 2025, the day of disclosure). - The latest release, 2.12.1, is not affected. ### [CVE-2025-54384](https://cve.now/CVE-2025-54384): CKAN stored XSS vulnerability in Markdown description fields - Severity: Medium 6.3 - Published: Oct 29, 2025 - Affected: fixed in 2.10.9; from 2.11.0, fixed in 2.11.4; from 2.11.0, fixed in 2.11.4; fixed in 2.10.9. - Fixed in 2.10.9 (released Oct 29, 2025, the day of disclosure) and 2.11.4 (released Oct 29, 2025, the day of disclosure). - The latest release, 2.12.1, is not affected. ### [CVE-2025-24372](https://cve.now/CVE-2025-24372): XSS vector in user uploaded images in group/org and user profiles in ckan - Severity: High 7.3 - Published: Feb 5, 2025 - Affected: fixed in 2.10.7; from 2.11.0, fixed in 2.11.2; fixed in 2.10.7; from 2.11.0, fixed in 2.11.2. - Fixed in 2.10.7 (released Feb 5, 2025, the day of disclosure) and 2.11.2 (released Feb 5, 2025, the day of disclosure). - The latest release, 2.12.1, is not affected. ### [CVE-2024-43371](https://cve.now/CVE-2024-43371): Potential access to sensitive URLs via CKAN extensions (SSRF) - Severity: Medium 4.5 - Published: Aug 21, 2024 - Affected: fixed in 2.10.5. - Fixed in 2.10.5 (released Aug 21, 2024, the day of disclosure). - The latest release, 2.12.1, is not affected. ### [CVE-2024-41675](https://cve.now/CVE-2024-41675): CKAN has a Cross-site Scripting vector in the Datatables view plugin - Severity: Medium 6.8 - Published: Aug 21, 2024 - Affected: from 2.7.0, fixed in 2.10.5. - Fixed in 2.10.5 (released Aug 21, 2024, the day of disclosure). - The latest release, 2.12.1, is not affected. ### [CVE-2024-41674](https://cve.now/CVE-2024-41674): CKAN may leak Solr credentials via error message in package\_search action - Severity: Medium 5.3 - Published: Aug 21, 2024 - Affected: from 2.0.0, fixed in 2.10.5. - Fixed in 2.10.5 (released Aug 21, 2024, the day of disclosure). - The latest release, 2.12.1, is not affected. ### [CVE-2024-27097](https://cve.now/CVE-2024-27097): Potential log injection in reset user endpoint in ckan - Severity: Medium 4.3 - Published: Mar 13, 2024 - Affected: fixed in 2.9.11; from 2.10.0, fixed in 2.10.4; fixed in 2.9.11; from 2.10.0, fixed in 2.10.4. - Fixed in 2.9.11 (released Mar 13, 2024, the day of disclosure) and 2.10.4 (released Mar 13, 2024, the day of disclosure). - The latest release, 2.12.1, is not affected. ### [CVE-2023-50248](https://cve.now/CVE-2023-50248): CKAN out of memory error when submitting the dataset form with a specially-crafted field - Severity: Medium 4.5 - Published: Dec 13, 2023 - Affected: from 2.0, fixed in 2.9.10; from 2.10.0, fixed in 2.10.3; from 2.0, fixed in 2.9.10; from 2.10.0, fixed in 2.10.3. - Fixed in 2.9.10 (released Dec 13, 2023, the day of disclosure) and 2.10.3 (released Dec 13, 2023, the day of disclosure). - The latest release, 2.12.1, is not affected. ### [CVE-2023-32321](https://cve.now/CVE-2023-32321): CKAN remote code execution and private information access via crafted resource ids - Severity: Critical 9.8 - Published: May 26, 2023 - Affected: fixed in 2.9.9; from 2.10.0, fixed in 2.10.1. - Fixed in 2.9.9 (released May 24, 2023, 2 days before disclosure) and 2.10.1 (released May 24, 2023, 2 days before disclosure). - The latest release, 2.12.1, is not affected. ### [CVE-2022-43685](https://cve.now/CVE-2022-43685): CKAN through 2.9.6 account takeovers by unauthenticated users when an existing user id is sent via an HTTP POST request. - Severity: High 8.8 - Published: Nov 22, 2022 - Affected: fixed in 2.9.7. - Fixed in 2.9.7 (released Oct 26, 2022, 27 days before disclosure). - The latest release, 2.12.1, is not affected. ### [CVE-2021-25967](https://cve.now/CVE-2021-25967): CKAN - Stored Cross-Site Scripting (XSS) via SVG File Upload - Severity: Medium 5.4 - Published: Dec 1, 2021 - Affected: from 2.9.0, fixed in 2.10.0; from 2.9.0, fixed in 2.9.4. - Fixed in 2.10.0 (released Feb 15, 2023, 441 days after disclosure). - The latest release, 2.12.1, is not affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/pypi/ckan Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.