A flaw in CKAN’s datastore_search_sql endpoint permits unauthenticated users to inject arbitrary SQL, allowing attackers to read private data and obtain PostgreSQL system information. The injection also bypasses normal authorization checks, effectively granting elevated privileges. The weakness is a classic SQL injection (CWE‑89) that can lead to confidentiality, integrity, and availability impacts on data exposed by a CKAN instance.

CKAN implementations prior to versions 2.10.10 and 2.11.5 are vulnerable. The issue exists in the core datastore module used by CKAN data hubs and portals. All releases of the affected series without the patch are affected.

The CVSS score of 8.3 classifies the vulnerability as high severity. The EPSS score is 14%, indicating a moderate‑to‑high likelihood of exploitation. The public advisory indicates that the flaw is exploitable by unauthenticated web traffic. The vulnerability is not listed in CISA KEV, but its impact on data portals makes it a priority. Attackers only need to send a crafted query to the datastore_search_sql endpoint, with no additional credentials, to achieve the threat.