Attack Chain

1. The attacker identifies a CKAN instance running a vulnerable version (prior to 2.10.10 or 2.11.0-2.11.4).
2. The attacker crafts a malicious HTTP request targeting the datastore_search_sql endpoint.
3. The malicious request contains a SQL injection payload within the parameters expected by datastore_search_sql.
4. CKAN’s datastore_search_sql function fails to properly sanitize the input, allowing the injected SQL code to be executed against the PostgreSQL database.
5. The injected SQL query retrieves sensitive data, such as private resource information, user credentials, or PostgreSQL system details.
6. The attacker extracts the compromised data from the HTTP response.
7. The attacker may use the compromised credentials to gain further access to the CKAN instance and its associated systems.

Impact

Successful exploitation of this SQL injection vulnerability can lead to unauthorized access to sensitive data stored within the CKAN DataStore, including private resources and user credentials. Attackers can also gain access to PostgreSQL system information, potentially leading to further system compromise. The number of affected organizations is unknown, but any organization running a vulnerable version of CKAN is at risk. If successful, the attack can lead to data breaches, financial losses, and reputational damage.

Recommendation

• Upgrade CKAN instances to version 2.10.10 or 2.11.5 to remediate CVE-2026-42031.
• As a temporary workaround, disable the DataStore SQL search by setting ckan.datastore.sqlsearch.enabled = false in the CKAN configuration, as mentioned in the overview.
• Monitor web server logs for suspicious requests targeting the datastore_search_sql endpoint, looking for SQL syntax within the query parameters using the Sigma rules provided below.