CVE-2026-129166

Description

Keep 0.34.10 through 0.55.0 contains a blind SQL injection vulnerability in its CEL-to-SQL converter, which inserts bracket-indexed JSON keys from CEL filters unescaped into JSON path expressions for SQLite, PostgreSQL, and MySQL. Authenticated users with read:alert permission can submit crafted CEL expressions to /alerts/query or the cel parameter of /incidents, using result counts as a boolean oracle to extract other tenants' alerts and password hashes.

References

• https://github.com/keephq/keep/blob/ab394bf49813b92377bbce4332d4f5cad1563a9c/keep/api/core/cel_to_sql/cel_ast_converter.py#L278-L290
• https://github.com/keephq/keep/blob/ab394bf49813b92377bbce4332d4f5cad1563a9c/keep/api/core/cel_to_sql/sql_providers/postgresql.py#L22-L26
• https://github.com/keephq/keep/blob/ab394bf49813b92377bbce4332d4f5cad1563a9c/keep/api/core/cel_to_sql/sql_providers/sqlite.py#L16-L18
• https://github.com/keephq/keep/issues/6902
• https://vul.yulun.ac.cn/20261030/keephq_keep/