CVE-2026-33505: 
NixOS vulnerability analysis and mitigation

CVE-2026-33505 is a SQL injection vulnerability in Ory Keto, an open-source authorization server for managing permissions at scale. The flaw exists in the GetRelationships API's pagination implementation, where pagination tokens encrypted with a publicly known default secret can be forged by attackers to inject arbitrary SQL. All versions prior to v26.2.0 are affected (specifically noted from v25.4.0). It was disclosed on March 20, 2026, and carries a CVSS v3.1 base score of 7.2 (High) (GitHub Advisory).

The root cause is improper neutralization of SQL special elements (CWE-89) within Keto's pagination token handling. Pagination tokens passed to the GetRelationships API are decrypted and used in SQL queries without sufficient sanitization. The tokens are encrypted using the secret defined in secrets.pagination; if this value is not configured, Keto falls back to a hard-coded default secret that is publicly known, allowing any attacker to forge valid tokens containing malicious SQL payloads. Exploitation requires network access to the GetRelationships API, the ability to supply a raw pagination token, and knowledge of (or the absence of) a custom secrets.pagination value (GitHub Advisory).

Successful exploitation allows an attacker to execute arbitrary SQL queries against the underlying database backing Ory Keto, resulting in high confidentiality, integrity, and availability impact. This could expose all stored relationship/permission data, allow unauthorized modification of authorization policies, and potentially disrupt the availability of the authorization service. Given Keto's role as a permissions management server, compromise could enable privilege escalation or bypass of access controls across dependent applications (GitHub Advisory).

No public proof-of-concept exploit code has been identified, and there is no known evidence of in-the-wild exploitation at this time. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS score is approximately 0.015% (0.000150), indicating low current exploitation probability. Exploitation is constrained by the requirement for high privileges or knowledge of the pagination secret, though the publicly known default secret significantly lowers the bar for unpatched, default-configured deployments (GitHub Advisory, Feedly).

1. Identify target: Locate an Ory Keto instance (prior to v26.2.0) where the GetRelationships API is accessible, either directly or indirectly (e.g., via an API gateway or internal service).
2. Determine pagination secret: Check whether the target uses the default hard-coded secrets.pagination value (publicly known from the Keto source code). If a custom secret is set, it must be obtained through other means.
3. Forge a malicious pagination token: Using the known or obtained secrets.pagination secret, craft a pagination token that, when decrypted by Keto, contains a SQL injection payload (e.g., appending ' OR '1'='1 or a UNION-based payload to the token's internal fields).
4. Encrypt the token: Encrypt the crafted payload using the same encryption scheme and secret that Keto uses for pagination tokens.
5. Submit the forged token: Send a GetRelationships API request (gRPC or REST) with the forged pagination token as the page_token parameter.
6. Achieve SQL injection: Keto decrypts the token and incorporates its contents into a SQL query without adequate sanitization, executing the attacker's arbitrary SQL against the backend database (GitHub Advisory).

• Network: Unusual or repeated calls to the GetRelationships API endpoint with non-standard or malformed page_token values; unexpected outbound database query volume from the Keto service.
• Logs: Keto application logs showing SQL errors, unexpected query structures, or database exceptions triggered during pagination token processing; anomalous pagination token values in API access logs.
• Database: Unexpected queries in database query logs (e.g., pg_stat_activity for PostgreSQL or general query log for MySQL) originating from the Keto service account that do not match normal relationship lookup patterns, including UNION, OR, or stacked queries.

The primary remediation is to upgrade Ory Keto to version 26.2.0 or later, which contains a fix for this vulnerability. As an immediate workaround prior to upgrading, configure a cryptographically secure custom value for secrets.pagination using a command such as openssl rand -base64 32, which prevents attackers from forging valid pagination tokens using the publicly known default. Additionally, restrict network access to the GetRelationships API to only trusted, authenticated clients where possible (GitHub Advisory, Ory Changelog).

Ory published a security advisory and changelog announcement covering this vulnerability alongside related issues in Ory Hydra (CVE-2026-33504) and other Ory products, all addressed in the v26.2.0 release (Ory Changelog). The vulnerability was also noted in the GitLab advisory database and tracked by several CVE aggregation services. No significant independent researcher commentary or broad media coverage has been identified beyond standard vulnerability tracking.