What’s Vulnerable › Products

ckan vulnerabilities

17 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 7 published in the last 12 months.

Check whether your ckan version is affected

Latest ckan vulnerabilities

• CVE-2026-42032 — CKAN: Unauthenticated Authorization Bypass in `datastore_search_sql` (CVSS 9.1)
• CVE-2026-42031 — CKAN: Unauthenticated SQL Injection and Authorization Bypass in `datastore_search_sql` (CVSS 9.8)
• CVE-2026-41255 — CKAN: CSRF exemption primed by anonymous requests (CVSS 6.1)
• CVE-2026-41132 — CKAN: No certificate validation on STMP connection (CVSS 7.4)
• CVE-2025-64100 — CKAN Vulnerable to Session Cookie Fixation (CVSS 6.1)
• CVE-2025-54384 — CKAN stored XSS vulnerability in Markdown description fields (CVSS 6.3)
• CVE-2025-24372 — XSS vector in user uploaded images in group/org and user profiles in ckan (CVSS 7.3)
• CVE-2024-43371 — Potential access to sensitive URLs via CKAN extensions (SSRF) (CVSS 6.5)
• CVE-2024-41675 — CKAN has a Cross-site Scripting vector in the Datatables view plugin (CVSS 6.1)
• CVE-2024-41674 — CKAN may leak Solr credentials via error message in package_search action (CVSS 5.3)
• CVE-2024-27097 — Potential log injection in reset user endpoint in ckan (CVSS 5.3)
• CVE-2023-50248 — CKAN out of memory error when submitting the dataset form with a specially-crafted field (CVSS 6.5)
• CVE-2023-32696 — Excessive permissions for ckan user (CVSS 8.8)
• CVE-2023-32321 — CKAN remote code execution and private information access via crafted resource ids (CVSS 9.8)
• CVE-2023-22746 — CKAN is vulnerable to session secret shared across instances using Docker images (CVSS 7.5)
• CVE-2022-43685 — (CVSS 8.8)
• CVE-2021-25967 — CKAN - Stored Cross-Site Scripting (XSS) via SVG File Upload (CVSS 5.4)