CVE-2026-33503: Ory Kratos SQL Injection via Forged Pagination Tokens
Summary
CVE-2026-33503: Ory Kratos has a SQL injection via forged pagination tokens. Affects github.com/ory/kratos versions < 1.3.1-0.20260320110106-9d7085948039. Fixed in 1.3.1-0.20260320110106-9d7085948039. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ory Kratos is an open-source identity and user management system designed to handle user authentication and authorization. It provides various features such as user registration, login, and session management. However, a vulnerability has been identified in its ListCourierMessages Admin API, which can be exploited through improper pagination token handling, leading to potential SQL injection attacks.
Vulnerability Detail
The vulnerability arises from the ListCourierMessages Admin API's flawed pagination implementation, which allows attackers to forge pagination tokens. If the 'secrets.pagination' configuration is not set or known, attackers can exploit this by crafting malicious tokens that can execute arbitrary SQL queries. This poses a significant risk as it could lead to unauthorized data access or manipulation.
How To Fix
Latest published version: v1.3.1 as of 23 Oct 2026
go get github.com/ory/kratos@v1.3.1Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.3.1-0.20260320110106-9d7085948039
This is the first release that contains the fix.
go get github.com/ory/kratos@v1.3.1-0.20260320110106-9d7085948039Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you cannot immediately update the package, ensure that the 'secrets.pagination' configuration is set to a strong, custom value to mitigate the risk of SQL injection through forged tokens.
Conclusion
In summary, the SQL injection vulnerability in Ory Kratos due to forged pagination tokens poses a significant risk to installations that do not properly configure their pagination secrets. Immediate action is required to secure the application by updating to the patched version and configuring the necessary secrets.
See every vulnerability recorded for github.com/ory/kratos →
FAQ
The vulnerability is a SQL injection flaw that allows attackers to execute arbitrary SQL queries through forged pagination tokens.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The CVSS score of this vulnerability is 7.2, indicating a high severity level.
If an immediate upgrade is not possible, ensure that the 'secrets.pagination' configuration is set to a strong, custom value to mitigate the risk.
You can find more information about Ory Kratos on its official GitHub repository and documentation.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/ory/kratos.
