CVE-2026-33505

CVE-2026-33505 describes a high-severity SQL injection vulnerability in Ory Keto versions prior to 26.2.0, specifically within its GetRelationships API. Attackers can exploit this by crafting malicious pagination tokens, particularly if the default or known `secrets.pagination` value is in use, enabling arbitrary SQL query execution. Rated 7.2 High on CVSS, the attack requires network access and high privileges but has low complexity, leading to a complete compromise of confidentiality, integrity, and availability. There is currently no evidence of active exploitation, nor are public exploit tools or code available. Community discussion regarding this vulnerability remains minimal.