QwikSec

Security Database

CVE

CWE

Training

CVE-2026-41132

Published: May 13, 2026

Modified: May 14, 2026

PUBLISHED

Description

CKAN is an open-source DMS (data management system) for powering data hubs and data portals. Prior to 2.10.10 and 2.11.5, the configured SMTP server may be spoofed with any certificate (e.g. self-signed), leaving credentials and all emails sent open to MITM attacks. This vulnerability is fixed in 2.10.10 and 2.11.5.

Vendor	Product	Versions
ckan	ckan	affected `>= 2.11.0, < 2.11.5` affected `< 2.10.10`

Weaknesses (CWE)

References

https://github.com/ckan/ckan/security/advisories/GHSA-mpfm-fpgx-647q

x_refsource_CONFIRM

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.