CVE-2026-33505
Ory Keto has a SQL injection via forged pagination tokens
Impact
## Description The **GetRelationships API** in Ory Keto is vulnerable to SQL injection due to flaws in its pagination implementation. Pagination tokens are encrypted using the secret configured in `secrets.pagination`. An attacker who knows this secret can craft their own tokens, including malicious tokens that lead to SQL injection. If this configuration value is not set, Keto falls back to a hard-coded default pagination encryption secret. Because this default value is publicly known, attackers can generate valid and malicious pagination tokens manually for installations where this secret is not set. ## Preconditions This issue can be exploited when all of the following conditions are met: - **GetRelationships API** is directly or indirectly accessible to the attacker - The attacker can pass a raw pagination token to the affected API - The configuration value `secrets.pagination` is not set or known to the attacker ## Impact An attacker can execute arbitrary SQL queries through forged pagination tokens. ## Mitigation As a first line of defense, **immediately** configure a custom value for `secrets.pagination` by generating a cryptographically secure random secret, for example: ``` openssl rand -base64 32 ``` Next, upgrade **Keto** to a fixed version **as soon as possible**.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| go | github.com/ory/keto | < 0.14.1-0.20260320140104-e4393662cd2e | 0.14.1-0.20260320140104-e4393662cd2e |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Ory | Keto | before 26.2.0 |