{"id":"CVE-2026-129166","summary":"Keep 0.34.10 through 0.55.0 Blind SQL Injection via CEL Bracket-Indexed JSON Keys","details":"Keep 0.34.10 through 0.55.0 contains a blind SQL injection vulnerability in its CEL-to-SQL converter, which inserts bracket-indexed JSON keys from CEL filters unescaped into JSON path expressions for SQLite, PostgreSQL, and MySQL. Authenticated users with read:alert permission can submit crafted CEL expressions to /alerts/query or the cel parameter of /incidents, using result counts as a boolean oracle to extract other tenants' alerts and password hashes.","modified":"2026-11-14T02:47:33.456460332Z","published":"2026-11-13T17:21:51.724Z","database_specific":{"cna_assigner":"VulnCheck","cwe_ids":["CWE-89"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/129xxx/CVE-2026-129166.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/129xxx/CVE-2026-129166.json"},{"type":"PACKAGE","url":"https://github.com/keephq/keep"},{"type":"ARTICLE","url":"https://github.com/keephq/keep/blob/ab394bf49813b92377bbce4332d4f5cad1563a9c/keep/api/core/cel_to_sql/cel_ast_converter.py#L278-L290"},{"type":"ARTICLE","url":"https://github.com/keephq/keep/blob/ab394bf49813b92377bbce4332d4f5cad1563a9c/keep/api/core/cel_to_sql/sql_providers/postgresql.py#L22-L26"},{"type":"ARTICLE","url":"https://github.com/keephq/keep/blob/ab394bf49813b92377bbce4332d4f5cad1563a9c/keep/api/core/cel_to_sql/sql_providers/sqlite.py#L16-L18"},{"type":"REPORT","url":"https://github.com/keephq/keep/issues/6902"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-129166"},{"type":"ADVISORY","url":"https://vul.yulun.ac.cn/20261030/keephq_keep/"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/keep-0.34.10-through-0.55.0-blind-sql-injection-via-cel-bracket-indexed-json-keys"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/keephq/keep","events":[{"introduced":"f648e6c7a43e04a9b87792714abbd4fef3b95ade"},{"last_affected":"ab394bf49813b92377bbce4332d4f5cad1563a9c"}],"database_specific":{"extracted_events":[{"range":[{"introduced":"0.34.10"},{"last_affected":"0.55.0"}],"source":"AFFECTED_FIELD","strategy":"StandardRange"}]}}],"versions":["v0.55.0","v0.54.3","v0.54.2","v0.54.1","v0.54.0","v0.53.0","v0.52.1","v0.52.0","v0.51.0","v0.50.0","v0.49.1","v0.49.0","v0.48.1","v0.48.0","v0.47.11","v0.47.10","v0.47.9","v0.47.8","v0.47.7","v0.47.6","v0.47.5","v0.47.4","v0.47.3","v0.47.2","v0.47.1","v0.47.0","v0.40.6","v0.46.5","v0.46.4","v0.46.3","v0.46.2","v0.46.1","v0.46.0","v0.45.15","v0.45.14","v0.45.13","v0.45.12","v0.45.11","v0.45.10","v0.45.9","v0.45.8","v0.45.7","v0.45.6","v0.45.5","v0.45.4","v0.45.3","v0.45.2","v0.45.1","v0.45.0","v0.44.13","v0.44.12","v0.44.11","v0.44.10","v0.44.9","v0.44.8","v0.44.7","v0.44.6","v0.44.5","v0.44.4","v0.44.3","v0.44.2","v0.44.1","v0.44.0","v0.43.14","v0.43.13","v0.43.12","v0.43.11","v0.43.10","v0.43.9","v0.43.8","v0.43.7","v0.43.6","v0.43.5","v0.43.4","v0.43.3","v0.43.2","v0.43.1","v0.43.0","v0.42.5","v0.42.4","v0.42.3","v0.42.2","v0.42.1","v0.42.0","v0.41.31","v0.41.30","v0.41.29","v0.41.28","v0.41.27","v0.41.26","v0.41.25","v0.41.24","v0.41.23","v0.41.22","v0.41.21","v0.41.20","v0.41.19","v0.41.18","v0.41.17","v0.41.16","v0.41.15","v0.41.14","v0.41.13","v0.41.12","v0.41.11","v0.41.10","v0.41.9","v0.41.8","v0.41.7","v0.41.6","v0.41.5","v0.41.4","v0.41.3","v0.41.2","v0.41.1","v0.41.0","v0.40.15","v0.40.14","v0.40.13","v0.40.12","v0.40.11","v0.40.10","v0.40.9","v0.40.8","v0.40.7","v0.40.5","v0.40.4","v0.40.3","v0.40.2","v0.40.1","v0.40.0","v0.39.10","v0.39.9","v0.39.8","v0.39.7","v0.39.6","v0.39.5","v0.39.4","v0.39.3","v0.39.2","v0.39.1","v0.39.0","v0.38.10","v0.38.9","v0.38.8","v0.38.7","v0.38.6","v0.38.5","v0.38.4","v0.38.3","v0.38.2","v0.38.1","v0.38.0","v0.37.21","v0.37.20","v0.37.19","v0.37.18","v0.37.17","v0.37.16","v0.37.15","v0.37.14","v0.37.13","v0.37.12","v0.37.11","v0.37.10","v0.37.9","v0.37.8","v0.37.7","v0.37.6","v0.37.5","v0.37.4","v0.37.3","v0.37.2","v0.37.1","v0.37.0","v0.36.11","v0.36.10","v0.36.9","v0.36.8","v0.36.7","v0.36.6","v0.36.5","v0.36.4","v0.36.3","v0.36.2","v0.36.1","v0.36.0","v0.35.17","v0.35.16","v0.35.15","v0.35.14","v0.35.13","v0.35.12","v0.35.11","v0.35.10","v0.35.9","v0.35.8","v0.35.7","v0.35.6","v0.35.5","v0.35.4","v0.35.3","v0.35.2","v0.35.1","v0.35.0","v0.34.13","v0.34.12","v0.34.11","v0.34.10"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-129166.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"}]}