What’s Vulnerable › Vulnerabilities

CVE-2022-1561: Crafted backend URLs in Lura Project

• Severity: medium (CVSS 4.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-08-01 · updated 2026-06-17
• Weakness: CWE-471

Description

Lura and KrakenD-CE versions older than v2.0.2 and KrakenD-EE versions older than v2.0.0 do not sanitize URL parameters correctly, allowing a malicious user to alter the backend URL defined for a pipe when remote users send crafty URL requests. The vulnerability does not affect KrakenD itself, but the consumed backend might be vulnerable.

Affected products

• Krakend: before 2.0.0; through 2.0.2 — fixed in 2.0.0
• Luraproject Lura: before 2.0.2 — fixed in 2.0.2

How to fix

Upgrade to a fixed version: Krakend 2.0.0; Luraproject Lura 2.0.2. Check the vendor advisory for mitigations.

References

• https://www.incibe-cert.es/en/early-warning/security-advisories/crafted-backend-urls-lura-project
• https://www.krakend.io/blog/cve-2022-1561-crafted-backend-urls/
• https://www.incibe-cert.es/en/early-warning/security-advisories/crafted-backend-urls-lura-project
• https://www.krakend.io/blog/cve-2022-1561-crafted-backend-urls/

Get alerted when CVE-2022-1561 or the next vulnerability affects your stack