CVE-2026-41132
EUVD-2026-3011613.05.2026, 19:17
CKAN is an open-source DMS (data management system) for powering data hubs and data portals. Prior to 2.10.10 and 2.11.5, the configured SMTP server may be spoofed with any certificate (e.g. self-signed), leaving credentials and all emails sent open to MITM attacks. This vulnerability is fixed in 2.10.10 and 2.11.5.Enginsight
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| okfn | ckan | 𝑥 < 2.10.10 |
| okfn | ckan | 2.11.0 ≤ 𝑥 < 2.11.5 |
𝑥
= Vulnerable software versions
Common Weakness Enumeration