CVE-2026-42032

描述

### Impact A vulnerability in `datastore_search_sql` allowed attackers to bypass authorization in order to gain access to private resources and PostgreSQL system information ### Patches The issue has been patched in CKAN 2.10.10 and CKAN 2.11.5 ### Workarounds Disable the DataStore SQL search (`ckan.datastore.sqlsearch.enabled = false`). Note that the SQL search is disabled by default. ### More information As stated in the [documentation](https://docs.ckan.org/en/2.11/maintaining/configuration.html#ckan-datastore-sqlsearch-enabled), this action function has protections that offer some safety but are not designed to prevent all types of abuse. Depending on the sensitivity of private data in your DataStore and the likelihood of abuse of your site, you may choose to disable this action function or restrict its use with a [`IAuthFunctions`](https://docs.ckan.org/en/2.11/extensions/plugin-interfaces.html#ckan.plugins.interfaces.IAuthFunctions) plugin. ### Credits * Reported by Arvin Shivram of Brutecat Security

如何修補 CVE-2026-42032

要修補 CVE-2026-42032,請將受影響套件升級到下列已修補版本。

• —升級至 2.10.10 或更新版本
• —升級至 2.10.10 或更新版本

CVE-2026-42032 正在被利用嗎?

低 — EPSS 為 0.4%,目前沒有觀察到大規模利用活動。

受影響套件(2)

• from 0, < 2.10.10
• from 0, < 2.10.10, >= 2.11.0, < 2.11.5

CVSS 分數

參考連結(9)

• ADVISORYgithub.com/advisories/GHSA-cg4x-64p3-x59h
• ADVISORYnvd.nist.gov/vuln/detail/CVE-2026-42032
• PATCHgithub.com/ckan/ckan
• PATCHpypi.org/project/ckan
• WEBdocs.ckan.org/en/2.10/changelog.html#v-2-10-10-2026-04-29