CVE-2026-33503 in kratos
Summary
by MITRE • 03/26/2026
Ory Kratos is an identity, user management and authentication system for cloud services. Prior to version 26.2.0, the ListCourierMessages Admin API in Ory Kratos is vulnerable to SQL injection due to flaws in its pagination implementation. Pagination tokens are encrypted using the secret configured in `secrets.pagination`. An attacker who knows this secret can craft their own tokens, including malicious tokens that lead to SQL injection. If this configuration value is not set, Kratos falls back to a default pagination encryption secret. Because this default value is publicly known, attackers can generate valid and malicious pagination tokens manually for installations where this secret is not set. As a first line of defense, immediately configure a custom value for `secrets.pagination` by generating a cryptographically secure random secret. Next, upgrade Kratos** to a fixed version, 26.2.0 or later, as soon as possible.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 03/26/2026
The vulnerability identified as CVE-2026-33503 affects Ory Kratos, a comprehensive identity, user management, and authentication system designed for cloud environments. This issue specifically targets the ListCourierMessages Admin API endpoint, which handles the retrieval of messaging information within the system. The vulnerability stems from a critical flaw in the pagination implementation that allows attackers to manipulate pagination tokens to execute malicious SQL commands. The affected system processes pagination tokens that are encrypted using a secret configured in the `secrets.pagination` parameter, creating a pathway for unauthorized SQL injection attacks when this security mechanism is compromised.
The technical exploitation of this vulnerability occurs through the manipulation of pagination tokens that are generated using encryption keys. When the `secrets.pagination` configuration value is not explicitly set, Ory Kratos defaults to a publicly known encryption secret, making it trivial for attackers to generate valid pagination tokens. This weakness directly maps to CWE-89, which defines SQL injection vulnerabilities where untrusted data is incorporated into SQL commands without proper sanitization. The attack vector leverages the predictable nature of default secrets, allowing malicious actors to construct pagination tokens that bypass normal access controls and execute arbitrary SQL queries against the underlying database system.
The operational impact of this vulnerability extends beyond simple data exfiltration, as it provides attackers with potential access to sensitive user information, authentication data, and messaging records stored within the Kratos system. The vulnerability affects installations where the default pagination encryption secret is in use, potentially compromising thousands of systems that have not properly configured their security parameters. Attackers can exploit this weakness to gain unauthorized access to user accounts, manipulate authentication records, or extract confidential information from the database backend. The attack requires minimal sophistication since the default secret is publicly documented, making this vulnerability particularly dangerous for organizations that have not implemented proper security hardening measures.
Organizations should immediately implement multiple defensive measures to address this vulnerability. The primary recommendation involves configuring a custom, cryptographically secure random secret for the `secrets.pagination` parameter, ensuring that pagination tokens cannot be easily generated or manipulated by unauthorized parties. This configuration change should be implemented as an immediate first-line defense before any system upgrades are performed. Additionally, organizations must upgrade their Ory Kratos installations to version 26.2.0 or later, which contains the necessary patches to address the SQL injection vulnerability in the pagination implementation. The upgrade process should include thorough testing to ensure that existing functionality remains intact while the security vulnerability is resolved. This vulnerability aligns with ATT&CK technique T1213.002, which covers data from information repositories, and represents a critical security gap that requires immediate attention to prevent potential data breaches and unauthorized system access.