GHSA-mpfm-fpgx-647qMedium

CKAN has no certificate validation on STMP connection

Published
April 29, 2026
Last Modified
May 14, 2026

🔗 CVE IDs covered (1)

CVE-2026-41132 →

📋 Description

Impact

Configured SMTP server may be spoofed with any certificate (e.g. self-signed), leaving credentials and all emails sent open to MITM attacks.

Patches

The vulnerability has been patched in CKAN 2.10.10 and CKAN 2.11.5

🎯 Affected products2

  • pip/ckan:>= 2.11.0, <= 2.11.4
  • pip/ckan:< 2.10.10

🔗 References (5)