Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
CKAN is an open-source DMS (data management system) for powering data hubs and data portals. Prior to 2.10.10 and 2.11.5, the configured SMTP server may be spoofed with any certificate (e.g. self-signed), leaving credentials and all emails sent open to MITM attacks. This vulnerability is fixed in 2.10.10 and 2.11.5.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-41132 CKAN is an open-source DMS (data management system) for powering data hubs and data portals. Prior to 2.10.10 and 2.11.5, the configured SMTP server may be spoofed wi… https://www.cve.org/CVERecord?id=CVE-2026-41132
Post summary
The post highlights an SMTP spoofing issue in CKAN and implicitly references patched versions (2.10.10/2.11.5), indicating a fix is available.
CVE-2026-41132 SMTP Server Certificate Spoofing in CKAN Before 2.10.10 and 2.11.5 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-41132
Post summary
A brief disclosure of a certificate spoofing vulnerability in CKAN (versions prior to 2.10.10 and 2.11.5) with a reference link to more details.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | okfn | ckan | - | - | - |