Blind SQL Injection Vulnerability in Keep by KeepHQ

CVE-2026-129166

What is CVE-2026-129166?

The version range of Keep, from 0.34.10 to 0.55.0, is susceptible to a blind SQL injection vulnerability through its CEL-to-SQL converter. This vulnerability arises from the handling of bracket-indexed JSON keys inserted into JSON path expressions using unescaped parameters, which can affect databases like SQLite, PostgreSQL, and MySQL. Users with an 'read:alert' permission can exploit this flaw by submitting malicious CEL expressions to specific endpoints, leading to the potential extraction of alerts and password hashes from other tenants.

References