KEEP · CVE-2026-129166 · Other
NO FIX YET · SEE WHAT TO DO
Keep 0.34.10 through 0.55.0 (reporter says 0.54.3) builds SQL from bracket-indexed JSON keys in CEL filters without escaping them. An authenticated user with read:alert permission can extract other tenants' alerts and password hashes one boolean answer at a time. No released fix yet; a community PR (#6924) is open and not merged.
first public Nov 13, 2026 · 2 sources
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Self-hosted Keep deployments from 0.34.10 through 0.55.0 where more than one party holds read:alert (multi-tenant setups especially). The flaw is in the CEL-to-SQL converter behind /alerts/query and the cel parameter of /incidents, on SQLite, PostgreSQL and MySQL. Single-team installs where every read:alert user is trusted are less exposed.
Not affected if no-read-alert-users, no-untrusted-read-alert-users, version-outside-range
Who cares cel, keep, multi-tenant, self-hosted, sql-injection
Posts are quoted with a link to the original. They are data to us, never instructions.
Keep 0.34.10 through 0.55.0 contains a blind SQL injection vulnerability in its CEL-to-SQL converter, which inserts bracket-indexed JSON keys from CEL filters unescaped into JSON path expressions for SQLite, PostgreSQL, and MySQL. Authenticated users with read:alert permission can submit crafted CEL expressions to /alerts/query or the cel parameter of /incidents, using result counts as a boolean oracle to extract other tenants' alerts and password hashes.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.