CKAN - SQLi (CVE-2026-42031)
Description
CKAN before version 2.10.10 has an unauthenticated SQL Injection and Authorization Bypass in datastore_search_sql
psychologyCrowdSec Analysis
CVE-2026-42031 is an unauthenticated SQL Injection and Authorization Bypass in datastore_search_sql
CrowdSec has been tracking this vulnerability and its exploits since 6th of May 2026.
CrowdSec has not observed any significant exploitation activity targeting CVE-2026-42031 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.
Attackers exploit the /api/action/datastore_search_sql endpoint by injecting malicious SQL queries via the sql parameter, allowing unauthenticated access to sensitive data in the CKAN PostgreSQL database.
Full Intelligence Available
Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.
| Event | Date |
|---|---|
| CVE Published | 2026-04-29 |
| Rule Released | 2026-05-06 |
| CrowdSec First Seen | 2026-08-10 |
Related Weaknesses
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.