CVE-2026-42032 is an authorization bypass in the datastore_search_sql action of CKAN, scored CVSS 9.1 (critical) in the NVD record. It can expose private resources and PostgreSQL system information. Upgrade to CKAN 2.10.10 or 2.11.5, or turn the SQL search off.
What's affected
The CKAN advisory lists the ckan package from pip, affected versions up to and including 2.11.4. The fixed versions are 2.10.10 and 2.11.5. The NVD record words it as prior to 2.10.10 and 2.11.5.
The weak spot is the datastore_search_sql action of the DataStore extension. The advisory notes that the SQL search is disabled by default, so many sites will not have this action switched on.
How to check if you're exposed
- Read your CKAN version.
pip show ckan
ckan --version
- Check whether DataStore SQL search is on. Look in your configuration file for the setting named in the advisory.
grep -n "ckan.datastore.sqlsearch.enabled" /etc/ckan/default/ckan.ini
- If the setting is true and your version is 2.11.4 or older (2.10.9 or older on the 2.10 line), you are exposed.
What to do now
- Upgrade to CKAN 2.10.10 or 2.11.5 or later.
- Until you can, set
ckan.datastore.sqlsearch.enabled = false, which is the workaround in the advisory. - If you need the action, consider restricting it with an IAuthFunctions plugin, as the advisory suggests.
- Review which datasets are private and what the database account behind DataStore can read.
- Also cover CVE-2026-42031, the SQL injection in the same action, which was fixed in the same releases.
Why it matters
The class is CWE-863, incorrect authorization. The action is meant to let callers query data they are allowed to see. The advisory says an attacker could get around that check and read private resources and PostgreSQL system information. The advisory also notes the action's own safeguards are not designed to stop every kind of abuse, which is why it suggests restricting or disabling it.
The advisory rates its own severity as moderate, while the NVD record scores 9.1. The gap exists because the score assumes the action is reachable without a login on an affected site. The KEV flag is false, and I found no report of exploitation in the wild.
Quick check
Should I disable the action even after upgrading?
The advisory says depending on how sensitive your private data is, you may choose to disable the action or restrict it with an IAuthFunctions plugin. That is a risk decision for you.
Sources
Last reviewed: 19 October 2026.
