UNKNOWN PyPI
CKAN has no certificate validation on STMP connection
GHSA-mpfm-fpgx-647q · CVE-2026-41132
Published · Modified
AI SAST
Find this class of vulnerability in your own code
Corgea's AI-native static analysis detects vulnerabilities like this one across your repositories, ranks them by exploitability, and returns review-ready fixes.
Description
Impact
Configured SMTP server may be spoofed with any certificate (e.g. self-signed), leaving credentials and all emails sent open to MITM attacks.
Patches
The vulnerability has been patched in CKAN 2.10.10 and CKAN 2.11.5
References
- WEB https://github.com/ckan/ckan/security/advisories/GHSA-mpfm-fpgx-647q
- ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-41132
- WEB https://docs.ckan.org/en/2.10/changelog.html#v-2-10-10-2026-04-29
- WEB https://docs.ckan.org/en/2.11/changelog.html#v-2-11-5-2026-04-29
- PACKAGE https://github.com/ckan/ckan
Ready to move
Start Securing
Free, no credit card | First findings in minutes