CVE-2022-1561: Krakend

Medium severity, CVSS 4.3. EPSS: 0.6% chance of exploitation in the next 30 days.

Lura and KrakenD-CE versions older than v2.0.2 and KrakenD-EE versions older than v2.0.0 do not sanitize URL parameters correctly, allowing a malicious user to alter the backend URL defined for a pipe when remote users send crafty URL requests. The vulnerability does not affect KrakenD itself, but the consumed backend might be vulnerable.

Affected products

• Krakend Krakend: before 2.0.0 (fixed in 2.0.0); up to and including 2.0.2
• Luraproject Lura: before 2.0.2 (fixed in 2.0.2)

Published 2022-08-01. Last modified 2026-06-17.