CVE-2026-65057 Details
Description
Keep (commit 91c75e0) contains a server-side request forgery vulnerability that allows unauthenticated attackers to make the backend issue arbitrary HTTP requests by supplying attacker-controlled host values to the unprotected healthcheck endpoint. Attackers can send a crafted JSON payload with a malicious host parameter to cause the backend to issue outbound requests to internal services or cloud metadata endpoints, enabling theft of cloud credentials and internal network reconnaissance.
A server-side request forgery (SSRF) vulnerability has been identified in Keep, specifically in commit 91c75e0. This vulnerability allows unauthenticated attackers to manipulate the backend into making arbitrary HTTP requests. By sending a crafted JSON payload with a malicious host parameter to the unprotected healthcheck endpoint, attackers can direct the backend to access internal services or cloud metadata endpoints. This could lead to the theft of cloud credentials and reconnaissance of internal networks.
The vulnerability has been addressed in Keep version 0.54.2 by adding authentication requirements to the healthcheck endpoint and implementing validation for the host values to prevent the use of private or loopback addresses.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 21, 2026CISA-ADP
Assessed Jul 22, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/keephq/keep/issues/6630 | CISA-ADP | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/keephq/keep | [email protected] | ProductSource CodeVendor |
| https://github.com/keephq/keep/issues/6630 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://www.vulncheck.com/advisories/keep-unauthenticated-server-side-request-forgery-via-post-providers-healthcheck | [email protected] | AdvisoryVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Keep | <= 91c75e0 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 22, 2026 | CVE Modified | CISA-ADP |
| Jul 21, 2026 | New CVE Received | [email protected] |