CVE-2026-129166: Keep 0.34.10 through 0.55.0 Blind SQL Injection via CEL Bracket-Indexed JSON Keys
Keep 0.34.10 through 0.55.0 contains a blind SQL injection vulnerability in its CEL-to-SQL converter, which inserts bracket-indexed JSON keys from CEL filters unescaped into JSON path expressions for SQLite, PostgreSQL, and MySQL. Authenticated users with read:alert permission can submit crafted CEL expressions to /alerts/query or the cel parameter of /incidents, using result counts as a boolean oracle to extract other tenants' alerts and password hashes.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
An authenticated user with the read:alert permission can exploit it. The vulnerable inputs are crafted CEL expressions submitted to /alerts/query or through the cel parameter of /incidents.
What data could be exposed?
An attacker can use result counts as a boolean oracle to extract alerts belonging to other tenants and password hashes. The issue affects the CEL-to-SQL conversion path for SQLite, PostgreSQL, and MySQL.
Which versions are affected?
Keep versions 0.34.10 through 0.55.0 are affected.