概要
CKAN often fronts public datasets, internal portals, and civic data catalogs. CVE-2026-42031 affects CKAN deployments where the DataStore SQL search action can cross the expected authorization boundary, creating SQL injection and unauthorized data-access risk.
仕組み
CKAN deployments affected by CVE-2026-42031 can expose DataStore SQL behavior without the expected authorization boundary. The risk is SQL injection and unauthorized access to data that should stay protected.
被害範囲
A confirmed exposure can reveal DataStore contents that were expected to be protected by CKAN authorization checks. Depending on what the deployment hosts, that can include unpublished datasets, operational metadata, or tenant-specific records.
// what fixvibe checks
What FixVibe checks
FixVibe checks this class with verified-domain active testing that is bounded, non-destructive, and evidence-driven. Public reports describe the affected surface and remediation. For check-specific questions about exact detection heuristics, active payload details, or source-code rule patterns, contact support@fixvibe.app.
鉄壁の防御
Upgrade CKAN to 2.10.10 or 2.11.5 or newer for the deployed release line. Disable DataStore SQL search when it is not required; otherwise restrict it to authenticated, authorized users and keep CKAN administrative surfaces behind trusted-network controls.