CSRF in Ckan
CVE-2026-41255
CKAN is an open-source DMS (data management system) for powering data hubs and data portals. Prior to 2.10.10 and 2.11.5, Access to the views via tokens or unauthenticated requests marked the endpoint as not requiring CSRF protection. The marking was a member variable in flask-wtf.csrf.CSRFProtect(), which was stored as a module level variable in the flask_app middleware. This API was never intended for request level changes, it is primarily a decorator for static configuration. An unauthenticated request could hit a protected endpoint, exempting it from CSRF protection for the life of the particular server process. (e.g. one worker of uwsgi). This vulnerability is fixed in 2.10.10 and 2.11.5.
Vulnerability class: CSRF (Cross-Site Request Forgery)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 6.1 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N.
EPSS exploit prediction
EPSS: 0.001 (2.6th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 3rd percentile — 2.6% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.001 · newest: 0.001 · change: +0.000
Affected products
Weakness classification (CWE)
References
- github.com/Shirshaw64p/security-advisories/tree/main/CVE-2026-41255 (Vendor Advisory)
- github.com/ckan/ckan/security/advisories/GHSA-mcvf-jxcw-vj73 (Vendor Advisory)
Frequently asked questions
- What is CVE-2026-41255?
- CVE-2026-41255 is a medium-severity vulnerability in Ckan, classified under Cross-Site Request Forgery (CSRF). CVSS score: 6.1/10. Published 2026-05-13.
- How severe is CVE-2026-41255?
- Medium severity. CVSS v3 base score is 6.1 out of 10.