Skip to content

Commit f6bb422

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-c38g-mx2c-9wf2 GHSA-hgx2-28f8-6g2r GHSA-r9w3-57w2-gch2
1 parent 0ea3045 commit f6bb422

3 files changed

Lines changed: 171 additions & 0 deletions

File tree

‎advisories/github-reviewed/2026/03/GHSA-c38g-mx2c-9wf2/GHSA-c38g-mx2c-9wf2.json‎

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-c38g-mx2c-9wf2",
4+
"modified": "2026-03-20T20:55:44Z",
5+
"published": "2026-03-20T20:55:44Z",
6+
"aliases": [
7+
"CVE-2026-33505"
8+
],
9+
"summary": "Ory Keto has a SQL injection via forged pagination tokens",
10+
"details": "## Description\n\nThe **GetRelationships API** in Ory Keto is vulnerable to SQL injection due to flaws in its pagination implementation.\n\nPagination tokens are encrypted using the secret configured in `secrets.pagination`. An attacker who knows this secret can craft their own tokens, including malicious tokens that lead to SQL injection. If this configuration value is not set, Keto falls back to a hard-coded default pagination encryption secret. Because this default value is publicly known, attackers can generate valid and malicious pagination tokens manually for installations where this secret is not set.\n\n## Preconditions\n\nThis issue can be exploited when all of the following conditions are met:\n\n- **GetRelationships API** is directly or indirectly accessible to the attacker\n- The attacker can pass a raw pagination token to the affected API\n- The configuration value `secrets.pagination` is not set or known to the attacker\n\n## Impact\n\nAn attacker can execute arbitrary SQL queries through forged pagination tokens.\n\n## Mitigation\n\nAs a first line of defense, **immediately** configure a custom value for `secrets.pagination` by generating a cryptographically secure random secret, for example:\n\n```\nopenssl rand -base64 32\n```\n\nNext, upgrade **Keto** to a fixed version **as soon as possible**.",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Go",
21+
"name": "github.com/ory/keto"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "0.14.1-0.20260320140104-e4393662cd2e"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
38+
"references": [
39+
{
40+
"type": "WEB",
41+
"url": "https://github.com/ory/keto/security/advisories/GHSA-c38g-mx2c-9wf2"
42+
},
43+
{
44+
"type": "PACKAGE",
45+
"url": "https://github.com/ory/keto"
46+
}
47+
],
48+
"database_specific": {
49+
"cwe_ids": [
50+
"CWE-89"
51+
],
52+
"severity": "HIGH",
53+
"github_reviewed": true,
54+
"github_reviewed_at": "2026-03-20T20:55:44Z",
55+
"nvd_published_at": null
56+
}
57+
}

‎advisories/github-reviewed/2026/03/GHSA-hgx2-28f8-6g2r/GHSA-hgx2-28f8-6g2r.json‎

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-hgx2-28f8-6g2r",
4+
"modified": "2026-03-20T20:54:54Z",
5+
"published": "2026-03-20T20:54:54Z",
6+
"aliases": [
7+
"CVE-2026-33503"
8+
],
9+
"summary": "Ory Kratos has a SQL injection via forged pagination tokens",
10+
"details": "## Description\n\nThe **ListCourierMessages** Admin API in Ory Kratos is vulnerable to SQL injection due to flaws in its pagination implementation.\n\nPagination tokens are encrypted using the secret configured in `secrets.pagination`. An attacker who knows this secret can craft their own tokens, including malicious tokens that lead to SQL injection. If this configuration value is not set, Kratos falls back to a default pagination encryption secret. Because this default value is publicly known, attackers can generate valid and malicious pagination tokens manually for installations where this secret is not set.\n\n## Preconditions\n\nThis issue can be exploited when the following conditions are met:\n\n- **ListCourierMessages API** is directly or indirectly accessible to the attacker\n- The attacker can pass a raw pagination token to the affected API\n- The configuration value `secrets.pagination` is not set or known to the attacker\n\n## Impact\n\nAn attacker can execute arbitrary SQL queries through forged pagination tokens.\n\n## Mitigation\n\nAs a first line of defense, **immediately** configure a custom value for `secrets.pagination` by generating a cryptographically secure random secret, for example:\n\n```\nopenssl rand -base64 32\n```\n\nNext, upgrade **Kratos** to a fixed version **as soon as possible**.",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Go",
21+
"name": "github.com/ory/kratos"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "1.3.1-0.20260320110106-9d7085948039"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
38+
"references": [
39+
{
40+
"type": "WEB",
41+
"url": "https://github.com/ory/kratos/security/advisories/GHSA-hgx2-28f8-6g2r"
42+
},
43+
{
44+
"type": "PACKAGE",
45+
"url": "https://github.com/ory/kratos"
46+
}
47+
],
48+
"database_specific": {
49+
"cwe_ids": [
50+
"CWE-89"
51+
],
52+
"severity": "HIGH",
53+
"github_reviewed": true,
54+
"github_reviewed_at": "2026-03-20T20:54:54Z",
55+
"nvd_published_at": null
56+
}
57+
}

‎advisories/github-reviewed/2026/03/GHSA-r9w3-57w2-gch2/GHSA-r9w3-57w2-gch2.json‎

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-r9w3-57w2-gch2",
4+
"modified": "2026-03-20T20:55:04Z",
5+
"published": "2026-03-20T20:55:04Z",
6+
"aliases": [
7+
"CVE-2026-33504"
8+
],
9+
"summary": "Ory Hydra has a SQL injection via forged pagination tokens",
10+
"details": "## Description\n\nFollowing Admin APIs in Ory Hydra are vulnerable to SQL injection due to flaws in its pagination implementation:\n\n- listOAuth2Clients\n- listOAuth2ConsentSessions\n- listTrustedOAuth2JwtGrantIssuers\n\nPagination tokens are encrypted using the secret configured in `secrets.pagination`. If this value is not set, Hydra falls back to using `secrets.system`. An attacker who knows this secret can craft their own tokens, including malicious tokens that lead to SQL injection.\n\n## Preconditions\n\nThis issue can be exploited when the following conditions are met:\n\n- One or more **admin APIs** listed above are directly or indirectly accessible to the attacker\n- The attacker can pass a raw pagination token to the affected API\n- The configuration value `secrets.pagination` is set and known to the attacker, or `secrets.pagination` is not set and `secrets.system` is known to the attacker\n\n## Impact\n\nAn attacker can execute arbitrary SQL queries through forged pagination tokens.\n\n## Mitigation\n\nAs a first line of defense, immediately configure a custom value for `secrets.pagination` by generating a cryptographically secure random secret, for example:\n\n```\nopenssl rand -base64 32\n```\n\nNext, upgrade **Hydra** to the fixed version **as soon as possible**.",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Go",
21+
"name": "github.com/ory/hydra"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "2.3.1-0.20260320110106-0b84568fffcc"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
38+
"references": [
39+
{
40+
"type": "WEB",
41+
"url": "https://github.com/ory/hydra/security/advisories/GHSA-r9w3-57w2-gch2"
42+
},
43+
{
44+
"type": "PACKAGE",
45+
"url": "https://github.com/ory/hydra"
46+
}
47+
],
48+
"database_specific": {
49+
"cwe_ids": [
50+
"CWE-89"
51+
],
52+
"severity": "HIGH",
53+
"github_reviewed": true,
54+
"github_reviewed_at": "2026-03-20T20:55:04Z",
55+
"nvd_published_at": null
56+
}
57+
}

0 commit comments

Comments
 (0)