CVE-2026-42032: CKAN Auth Bypass Vulnerability

CVE-2026-42032 Overview

CKAN is an open-source data management system (DMS) used to power data hubs and data portals. CVE-2026-42032 is an authorization bypass vulnerability [CWE-863] in the datastore_search_sql function. The flaw lets unauthenticated network attackers read private resources and extract PostgreSQL system information. The issue affects CKAN versions prior to 2.10.10 and prior to 2.11.5. Patched releases 2.10.10 and 2.11.5 resolve the vulnerability.

Critical Impact

Remote unauthenticated attackers can bypass authorization checks in datastore_search_sql to read private datasets and disclose PostgreSQL backend metadata.

Affected Products

• CKAN versions prior to 2.10.10
• CKAN versions prior to 2.11.5
• Deployments exposing the DataStore extension via the CKAN API

Discovery Timeline

• 2026-05-13 - CVE-2026-42032 published to NVD
• 2026-05-13 - Last updated in NVD database

Technical Details for CVE-2026-42032

Vulnerability Analysis

The vulnerability resides in CKAN's datastore_search_sql API action, which accepts raw SQL queries against the DataStore PostgreSQL backend. The action is intended to enforce access control so that callers can only query resources they are authorized to read. Authorization checks in vulnerable versions do not fully constrain the SQL the user supplies. As a result, an attacker can craft queries that reference private resources or PostgreSQL system catalogs and receive data back through the API response.

The weakness maps to CWE-863: Incorrect Authorization. The decision logic exists but fails to cover all query paths reachable through datastore_search_sql.

Root Cause

CKAN exposes a SQL search endpoint backed by PostgreSQL. The authorization layer evaluates the requested resource but does not adequately validate the structure or targets of the submitted SQL. Attackers can construct queries that read tables outside the caller's permission scope, including private resource tables and PostgreSQL internal catalogs such as pg_catalog and information_schema.

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker sends a crafted POST request to the datastore_search_sql API action with a SQL statement that references private resource identifiers or system catalogs. The CKAN server executes the query against PostgreSQL and returns the result set to the unauthenticated caller, disclosing private content.

No verified public exploit code is available. Refer to the GitHub Security Advisory GHSA-cg4x-64p3-x59h for technical details.

Detection Methods for CVE-2026-42032

Indicators of Compromise

• Requests to /api/3/action/datastore_search_sql from unauthenticated sources or unexpected client IPs.
• SQL payloads that reference pg_catalog, information_schema, or resource IDs not owned by the requester.
• Anomalous spikes in DataStore API response sizes correlating with single-source query bursts.

Detection Strategies

• Inspect CKAN access logs for POST requests to datastore_search_sql and decode the sql parameter for catalog references.
• Enable PostgreSQL log_statement = 'all' on the DataStore role and alert on queries touching system catalogs.
• Correlate API caller identity with the resource IDs referenced in submitted SQL to flag mismatches.

Monitoring Recommendations

• Forward CKAN application logs and PostgreSQL query logs to a centralized analytics platform for retention and search.
• Baseline normal datastore_search_sql usage per API token and alert on deviations in query volume or target tables.
• Monitor egress traffic from the CKAN host for large or repeated JSON responses tied to DataStore endpoints.

How to Mitigate CVE-2026-42032

Immediate Actions Required

• Upgrade CKAN to version 2.10.10 or 2.11.5 as soon as possible.
• Audit recent CKAN logs for unauthorized calls to datastore_search_sql and review any private resources potentially exposed.
• Rotate any secrets, API tokens, or credentials that may have been stored in DataStore tables.

Patch Information

The CKAN maintainers fixed this vulnerability in releases 2.10.10 and 2.11.5. Patch details and remediation guidance are published in the CKAN GitHub Security Advisory GHSA-cg4x-64p3-x59h.

Workarounds

• Disable the datastore_search_sql action at the CKAN API layer if upgrading is not immediately feasible.
• Restrict the PostgreSQL DataStore read role so it cannot access tables outside the published DataStore schema.
• Place CKAN behind a reverse proxy or WAF that blocks datastore_search_sql requests from untrusted networks.

# Configuration example: disable the vulnerable action via CKAN config
# In ckan.ini / production.ini
ckan.plugins = ... datastore  # ensure datastore plugin config is reviewed

# Block the endpoint at the reverse proxy (nginx) until patched
location = /api/3/action/datastore_search_sql {
    return 403;
}