What is CVE-2022-1561?

CVE-2022-1561 is a medium-severity vulnerability in Krakend, classified under Modification of Assumed-Immutable Data (MAID). CVSS score: 4.0/10. Published 2022-08-01.

How severe is CVE-2022-1561?

Medium severity. CVSS v3 base score is 4.0 out of 10.

Vulnerability in Krakend

CVE-2022-1561

Lura and KrakenD-CE versions older than v2.0.2 and KrakenD-EE versions older than v2.0.0 do not sanitize URL parameters correctly, allowing a malicious user to alter the backend URL defined for a pipe when remote users send crafty URL requests. The vulnerability does not affect KrakenD itself, but the consumed backend might be vulnerable.

Published 2022-08-01 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 4.0 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N.

EPSS exploit prediction

EPSS: 0.006 (45.4th percentile), scored 2026-10-04.

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 45th percentile — 45.4% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.006 · newest: 0.006 · change: +0.000

Affected products

Krakend
Krakend Krakend-Ce — versions v2.0.2
Krakend Krakend-Ee — versions v2.0.0
Krakend Lura Project — versions v2.0.2
Luraproject Lura

Weakness classification (CWE)

CWE-471 — Modification of Assumed-Immutable Data (MAID)

References

www.incibe-cert.es/en/early-warning/security-advisories/crafted-backend-urls-lu… (Third Party Advisory)
www.krakend.io/blog/cve-2022-1561-crafted-backend-urls/ (Vendor Advisory)

Frequently asked questions

What is CVE-2022-1561?: CVE-2022-1561 is a medium-severity vulnerability in Krakend, classified under Modification of Assumed-Immutable Data (MAID). CVSS score: 4.0/10. Published 2022-08-01.
How severe is CVE-2022-1561?: Medium severity. CVSS v3 base score is 4.0 out of 10.