PT-2026-26789 · Ory · Ory Keto

Published

2026-03-20

·

Updated

2026-03-29

·

CVE-2026-33505

CVSS v3.1

7.2

High

VectorAV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Ory Keto (affected versions not specified)
Description The GetRelationships API in Ory Keto is susceptible to SQL injection due to flaws in its pagination implementation. Pagination tokens are encrypted using the secret configured in secrets.pagination. An attacker who knows this secret can craft their own tokens, including malicious tokens that lead to SQL injection. If the secrets.pagination configuration value is not set, Keto defaults to a publicly known, hard-coded pagination encryption secret, allowing attackers to generate valid and malicious pagination tokens. An attacker can execute arbitrary SQL queries through these forged pagination tokens. The API endpoint vulnerable is /relationships.
Recommendations Immediately configure a custom value for secrets.pagination by generating a cryptographically secure random secret, for example, using openssl rand -base64 32. Upgrade Keto to a fixed version as soon as possible.

Exploit

Fix

SQL injection

Weakness Enumeration

Related Identifiers

CVE-2026-33505
GHSA-C38G-MX2C-9WF2
GO-2026-4800
SUSE-SU-2026:1135-1

Affected Products

Ory Keto