CVE-2026-41255 — CKAN is an open-source DMS (data management system) for

title: CVE-2026-41255 - CKAN Unauthenticated CSRF Exemption via View Endpoint
id: scw-2026-05-13-ai-1
status: experimental
level: medium
description: |
  This rule detects unauthenticated GET requests to specific CKAN API endpoints that were vulnerable to CSRF protection bypass in versions prior to 2.10.10 and 2.11.5. Exploitation involved accessing views via tokens or unauthenticated requests, which could exempt the endpoint from CSRF protection for the duration of the server process. This bypass could be leveraged for further exploitation.
author: SCW Feed Engine (AI-generated)
date: 2026-05-13
references:
  - https://shimiscyberworld.com/posts/nvd-CVE-2026-41255/
tags:
  - attack.initial_access
  - attack.t1190
logsource:
    category: webserver
detection:
  selection:
      cs-uri|contains:
          - '/api/action/package_show'
          - '/api/action/package_list'
      cs-method:
          - 'GET'
      sc-status:
          - '200'
  condition: selection
falsepositives:
  - Legitimate administrative activity

Source: Shimi's Cyber World · License & reuse