CKAN may leak Solr credentials via error message in package_search action

GHSA-2rqw-cfhc-35fh · CVE-2024-41674 · PYSEC-2026-1248

Published Aug 21, 2024 · Modified Jul 7, 2026

AI SAST

Find this class of vulnerability in your own code

Corgea's AI-native static analysis detects vulnerabilities like this one across your repositories, ranks them by exploitability, and returns review-ready fixes.

Explore AI SAST Explore dependency scanning →

Description

If there were connection issues with the Solr server, the internal Solr URL (potentially including credentials) could be leaked to package_search calls as part of the returned error message

Patches

This has been patched in CKAN 2.10.5 and 2.11.0

References

WEB https://github.com/ckan/ckan/security/advisories/GHSA-2rqw-cfhc-35fh
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2024-41674
WEB https://github.com/ckan/ckan/commit/f6b032cd7082d784938165bbd113557639002ca7
PACKAGE https://github.com/ckan/ckan

Ready to move

Start Securing

Start for Free Get Demo

Free, no credit card | First findings in minutes