CVE-2026-33505: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in ory keto
Ory Keto is am open source authorization server for managing permissions at scale. Prior to version 26.2.0, the GetRelationships API in Ory Keto is vulnerable to SQL injection due to flaws in its pagination implementation. Pagination tokens are encrypted using the secret configured in `secrets.pagination`. An attacker who knows this secret can craft their own tokens, including malicious tokens that lead to SQL injection. If this configuration value is not set, Keto falls back to a hard-coded default pagination encryption secret. Because this default value is publicly known, attackers can generate valid and malicious pagination tokens manually for installations where this secret is not set. This issue can be exploited when GetRelationships API is directly or indirectly accessible to the attacker, the attacker can pass a raw pagination token to the affected API, and the configuration value `secrets.pagination` is not set or known to the attacker. An attacker can execute arbitrary SQL queries through forged pagination tokens. As a first line of defense, immediately configure a custom value for `secrets.pagination` by generating a cryptographically secure random secret. Next, upgrade Keto to a fixed version, 26.2.0 or later, as soon as possible.
AI Analysis
Technical Summary
Ory Keto, an open source authorization server, has a SQL injection vulnerability (CWE-89) in its GetRelationships API prior to version 26.2.0. The issue arises from flaws in the pagination implementation where pagination tokens are encrypted using a secret configured in `secrets.pagination`. If this secret is unset, Keto falls back to a hard-coded default secret that is publicly known. Attackers who know or exploit the absence of this secret can craft malicious pagination tokens that trigger SQL injection when processed by the API. This vulnerability requires the attacker to have direct or indirect access to the GetRelationships API and knowledge or absence of the pagination secret. The vulnerability is addressed by configuring a strong custom secret and upgrading Keto to version 26.2.0 or later.
Potential Impact
Successful exploitation allows an attacker to execute arbitrary SQL queries on the backend database via crafted pagination tokens in the GetRelationships API. This can lead to complete compromise of data confidentiality, integrity, and availability within the affected Ory Keto instance. The CVSS 3.1 base score is 7.2, indicating high severity with network attack vector, low attack complexity, high impact on confidentiality, integrity, and availability, and requiring high privileges but no user interaction.
Mitigation Recommendations
A fix is available in Ory Keto version 26.2.0 and later. Users should upgrade to this version as soon as possible. As an immediate mitigation, configure a custom, cryptographically secure random value for the `secrets.pagination` configuration to replace the default secret. This prevents attackers from crafting valid malicious pagination tokens. No other mitigations are specified by the vendor advisory.
CVE-2026-33505: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in ory keto
Description
Ory Keto is am open source authorization server for managing permissions at scale. Prior to version 26.2.0, the GetRelationships API in Ory Keto is vulnerable to SQL injection due to flaws in its pagination implementation. Pagination tokens are encrypted using the secret configured in `secrets.pagination`. An attacker who knows this secret can craft their own tokens, including malicious tokens that lead to SQL injection. If this configuration value is not set, Keto falls back to a hard-coded default pagination encryption secret. Because this default value is publicly known, attackers can generate valid and malicious pagination tokens manually for installations where this secret is not set. This issue can be exploited when GetRelationships API is directly or indirectly accessible to the attacker, the attacker can pass a raw pagination token to the affected API, and the configuration value `secrets.pagination` is not set or known to the attacker. An attacker can execute arbitrary SQL queries through forged pagination tokens. As a first line of defense, immediately configure a custom value for `secrets.pagination` by generating a cryptographically secure random secret. Next, upgrade Keto to a fixed version, 26.2.0 or later, as soon as possible.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Ory Keto, an open source authorization server, has a SQL injection vulnerability (CWE-89) in its GetRelationships API prior to version 26.2.0. The issue arises from flaws in the pagination implementation where pagination tokens are encrypted using a secret configured in `secrets.pagination`. If this secret is unset, Keto falls back to a hard-coded default secret that is publicly known. Attackers who know or exploit the absence of this secret can craft malicious pagination tokens that trigger SQL injection when processed by the API. This vulnerability requires the attacker to have direct or indirect access to the GetRelationships API and knowledge or absence of the pagination secret. The vulnerability is addressed by configuring a strong custom secret and upgrading Keto to version 26.2.0 or later.
Potential Impact
Successful exploitation allows an attacker to execute arbitrary SQL queries on the backend database via crafted pagination tokens in the GetRelationships API. This can lead to complete compromise of data confidentiality, integrity, and availability within the affected Ory Keto instance. The CVSS 3.1 base score is 7.2, indicating high severity with network attack vector, low attack complexity, high impact on confidentiality, integrity, and availability, and requiring high privileges but no user interaction.
Mitigation Recommendations
A fix is available in Ory Keto version 26.2.0 and later. Users should upgrade to this version as soon as possible. As an immediate mitigation, configure a custom, cryptographically secure random value for the `secrets.pagination` configuration to replace the default secret. This prevents attackers from crafting valid malicious pagination tokens. No other mitigations are specified by the vendor advisory.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-03-20T16:59:08.888Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 69c582253c064ed76fa7cc80
Added to database: 3/26/2026, 6:59:49 PM
Last enriched: 4/3/2026, 1:07:17 PM
Last updated: 5/10/2026, 8:30:45 AM
Views: 49
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.