Detections
Analytics

SCA: security update for github.com/ory/hydra/v2 (GHSA-r9w3-57w2-gch2)

high Tenable Self-Hosted Container Security Plugin ID 439080

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Ory Hydra is an OAuth 2.0 Server and OpenID Connect Provider. Prior to version 26.2.0, the
 listOAuth2Clients, listOAuth2ConsentSessions, and listTrustedOAuth2JwtGrantIssuers Admin APIs in Ory Hydra
 are vulnerable to SQL injection due to flaws in its pagination implementation. Pagination tokens are
 encrypted using the secret configured in `secrets.pagination`. If this value is not set, Hydra falls back
 to using `secrets.system`. An attacker who knows this secret can craft their own tokens, including
 malicious tokens that lead to SQL injection. This issue can be exploited when one or more admin APIs
 listed above are directly or indirectly accessible to the attacker; the attacker can pass a raw pagination
 token to the affected API; and the configuration value `secrets.pagination` is set and known to the
 attacker, or `secrets.pagination` is not set and `secrets.system` is known to the attacker. An attacker
 can execute arbitrary SQL queries through forged pagination tokens. As a first line of defense,
 immediately configure a custom value for `secrets.pagination` by generating a cryptographically secure
 random secret. Next, upgrade Hydra to the fixed version, 26.2.0 as soon as possible. (CVE-2026-33504)

Solution

Update the github.com/ory/hydra/v2 library and its related packages to version 2.3.1-0.20260320110106-0b84568fffcc or later.

See Also

https://github.com/advisories/GHSA-r9w3-57w2-gch2

Plugin Details

Severity: High

ID: 439080

Version: Revision 1.14

Type: Local

Family: SCA Checks

Published: 3/21/2026

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 57.88

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: High

Base Score: 8.3

Temporal Score: 6.1

Vector: CVSS2#AV:N/AC:L/Au:M/C:C/I:C/A:C

CVSS Score Source: CVE-2026-33504

CVSS v3

Risk Factor: High

Base Score: 7.2

Temporal Score: 6.3

Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 3/20/2026

Vulnerability Publication Date: 3/20/2026

Reference Information

CVE: CVE-2026-33504

cwe: CWE-89