CVE-2023-22746

CKAN is an open-source DMS (data management system) for powering data hubs and data portals. When creating a new container based on one of the Docker images listed below, the same secret key was being used by default. If the users didn't set a custom value via environment variables in the `.env` file, that key was shared across different CKAN instances, making it easy to forge authentication requests. Users overriding the default secret key in their own `.env` file are not affected by this issue. Note that the legacy images (ckan/ckan) located in the main CKAN repo are not affected by this issue. The affected images are ckan/ckan-docker, (ckan/ckan-base images), okfn/docker-ckan (openknowledge/ckan-base and openknowledge/ckan-dev images) keitaroinc/docker-ckan (keitaro/ckan images).

• CWE-330
• CWE-344

• https://github.com/ckan/ckan/commit/44af0f0a148fcc0e0fbcf02fe69b7db13459a84bPatch
• https://github.com/ckan/ckan/commit/4c22c135fa486afa13855d1cdb9765eaf418d2aaPatch
• https://github.com/ckan/ckan/security/advisories/GHSA-pr8j-v4c8-h62xThird Party Advisory
• https://github.com/ckan/ckan/commit/44af0f0a148fcc0e0fbcf02fe69b7db13459a84bPatch
• https://github.com/ckan/ckan/commit/4c22c135fa486afa13855d1cdb9765eaf418d2aaPatch
• https://github.com/ckan/ckan/security/advisories/GHSA-pr8j-v4c8-h62xThird Party Advisory

Published

Feb 3, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-2274Rejected reason: This CVE assignment was considered invalid …
• CVE-2023-22740Discourse is an open source platform for community discussio…6.5
• CVE-2023-22741Sofia-SIP is an open-source SIP User-Agent library, complian…9.8
• CVE-2023-22742libgit2 is a cross-platform, linkable library implementation…5.9
• CVE-2023-22743Git for Windows is the Windows port of the revision control …7.3
• CVE-2023-22745tpm2-tss is an open source software implementation of the Tr…6.4
• CVE-2023-22747There are multiple command injection vulnerabilities that co…9.8
• CVE-2023-22748 There are multiple command injection vulnerabilities that c…9.8
• CVE-2023-22749 There are multiple command injection vulnerabilities that c…9.8
• CVE-2023-2275The WooCommerce Multivendor Marketplace – REST API plugin fo…5.4
• CVE-2023-22750 There are multiple command injection vulnerabilities that c…9.8
• CVE-2023-22751There are stack-based buffer overflow vulnerabilities that c…9.8