The CKAN data management system fails to validate TLS certificates when connecting to an SMTP server. This omission allows an attacker to substitute a self‑signed or otherwise forged certificate so that the system believes it is communicating with a legitimate mail server. As a consequence, all SMTP credentials that CKAN forwards to the server, along with every email it sends, can be harvested by the attacker, exposing confidential data and enabling further phishing or spoofing attacks. The flaw is an instance of certificate validation weakness (CWE‑295).

CKAN versions earlier than 2.10.10 and 2.11.5 are affected. The vulnerability applies to any deployment of CKAN that uses the default SMTP configuration and does not explicitly enforce certificate verification.

With a CVSS score of 6.6 the vulnerability represents moderate risk. The EPSS score is not available, and the flaw is not listed in CISA’s KEV catalogue, indicating limited publicly known exploitation. The likely attack path involves an attacker impersonating the SMTP server in the network path between the CKAN instance and the mail host, or compromising DNS to redirect traffic. Because CKAN accepts arbitrary certificates, the attacker can perform a man‑in‑the‑middle attack without needing privileged access to the CKAN server itself.