CVE-2026-41255

CKAN is an open-source DMS (data management system) for powering data hubs and data portals. Prior to 2.10.10 and 2.11.5, Access to the views via tokens or unauthenticated requests marked the endpoint as not requiring CSRF protection. The marking was a member variable in flask-wtf.csrf.CSRFProtect(), which was stored as a module level variable in the flask_app middleware. This API was never intended for request level changes, it is primarily a decorator for static configuration. An unauthenticated request could hit a protected endpoint, exempting it from CSRF protection for the life of the particular server process. (e.g. one worker of uwsgi). This vulnerability is fixed in 2.10.10 and 2.11.5.

• CWE-352

• https://github.com/Shirshaw64p/security-advisories/tree/main/CVE-2026-41255Vendor Advisory
• https://github.com/ckan/ckan/security/advisories/GHSA-mcvf-jxcw-vj73Vendor Advisory
• https://github.com/ckan/ckan/security/advisories/GHSA-mcvf-jxcw-vj73Vendor Advisory

Published

May 13, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-41249CoreShop is a Pimcore enhanced eCommerce solution. In versio…8.2
• CVE-2026-4125The WPMK Block plugin for WordPress is vulnerable to Stored …6.4
• CVE-2026-41250Taiga is a project management platform for startups and agil…5.7
• CVE-2026-41252xrdp is an open source RDP server. Versions 0.10.6 and prior…9.8
• CVE-2026-41253In iTerm2 through 3.6.9, displaying a .txt file can cause co…7.8
• CVE-2026-41254Little CMS (lcms2) through 2.18 has an integer overflow in C…7.5
• CVE-2026-41256jq is a command-line JSON processor. In 1.8.1 and earlier, T…5.5
• CVE-2026-41257jq is a command-line JSON processor. In 1.8.1 and earlier, t…5.5
• CVE-2026-41258OpenMRS is an open source electronic medical record system p…9.1
• CVE-2026-41259Mastodon is a free, open-source social network server based …7.5
• CVE-2026-4126The Table Manager plugin for WordPress is vulnerable to Sens…4.3
• CVE-2026-41263Traefik is an HTTP reverse proxy and load balancer. Prior to…3.7