CVE-2026-42031 is an SQL injection flaw in the datastore_search_sql action of CKAN, scored CVSS 9.8 (critical) in the NVD record. It can expose private resources and PostgreSQL system information. Upgrade to CKAN 2.10.10 or 2.11.5, or turn the SQL search off.
What's affected
The CKAN advisory lists the ckan package from pip, affected versions up to and including 2.11.4. The fixed versions are 2.10.10 and 2.11.5. The NVD record words it as prior to 2.10.10 and 2.11.5.
The weak spot is the datastore_search_sql action of the DataStore extension. The advisory notes that the SQL search is disabled by default, so many sites will not have this action switched on.
How to check if you're exposed
- Read your CKAN version.
pip show ckan
ckan --version
- Check whether DataStore SQL search is on. Look in your configuration file for the setting named in the advisory.
grep -n "ckan.datastore.sqlsearch.enabled" /etc/ckan/default/ckan.ini
- If the setting is true and your version is 2.11.4 or older (2.10.9 or older on the 2.10 line), you are exposed.
What to do now
- Upgrade to CKAN 2.10.10 or 2.11.5 or later.
- Until you can, set
ckan.datastore.sqlsearch.enabled = false, which is the workaround in the advisory. - If you need the action, consider restricting it with an IAuthFunctions plugin, as the advisory suggests.
- Review which datasets are private and what the database account behind DataStore can read.
- Also cover CVE-2026-42032, the authorization bypass in the same action, which was fixed in the same releases.
Why it matters
The class is CWE-89, improper neutralization of special elements in an SQL command. The action takes SQL from the caller, and the advisory says its built in protections offer some safety but are not designed to prevent all types of abuse. This flaw let an attacker inject SQL past them to reach private resources and PostgreSQL system information.
The advisory rates its own severity as moderate, while the NVD record scores 9.8. The gap exists because the score assumes the action is reachable without a login on an affected site. The KEV flag is false, and I found no report of exploitation in the wild.
Quick check
Is the DataStore SQL search on by default?
No. The advisory says it is disabled by default and names ckan.datastore.sqlsearch.enabled as the setting. Confirm in your own configuration rather than assuming.
Sources
Last reviewed: 19 October 2026.
