CVE-2026-65057 in Keep
Summary
by MITRE • 07/22/2026
Keep (commit 91c75e0) contains a server-side request forgery vulnerability that allows unauthenticated attackers to make the backend issue arbitrary HTTP requests by supplying attacker-controlled host values to the unprotected healthcheck endpoint. Attackers can send a crafted JSON payload with a malicious host parameter to cause the backend to issue outbound requests to internal services or cloud metadata endpoints, enabling theft of cloud credentials and internal network reconnaissance.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/22/2026
The vulnerability exists within the Keep application at commit 91c75e0 and represents a critical server-side request forgery flaw that undermines the system's security posture. This weakness allows unauthenticated attackers to manipulate the backend service by injecting malicious host values through an unprotected healthcheck endpoint. The flaw stems from insufficient input validation and sanitization mechanisms that fail to properly validate or restrict user-supplied host parameters before processing them within the application's request handling logic.
The technical implementation of this vulnerability enables attackers to craft specifically formatted JSON payloads containing malicious host values that bypass normal security controls. When the backend processes these requests through the healthcheck endpoint, it performs outbound HTTP requests using the attacker-controlled host parameter without proper validation or restriction. This behavior creates a pathway for attackers to indirectly access internal network resources and cloud metadata services that would normally be restricted from external access.
The operational impact of this vulnerability extends beyond simple information disclosure to encompass comprehensive internal network reconnaissance and credential theft capabilities. Attackers can leverage this flaw to target internal services, databases, or other backend systems that reside within the same network segment as the vulnerable application. The ability to reach cloud metadata endpoints represents a particularly dangerous aspect of this vulnerability, as these services often contain sensitive credentials and configuration data that can be used to escalate privileges or gain access to additional resources within cloud environments.
This vulnerability aligns with CWE-918, which classifies server-side request forgery as a weakness where applications fail to properly validate or restrict user-provided URLs or hostnames. The flaw also maps to several ATT&CK techniques including T1046 for network service scanning and T1566 for credential access through social engineering or exploitation of vulnerable services. Organizations utilizing the Keep application at this commit level face significant risk of unauthorized access to internal systems and potential data breaches.
Mitigation strategies should focus on implementing strict input validation and sanitization controls that reject or properly encode any user-supplied host parameters before they reach the backend HTTP request processing layer. The healthcheck endpoint should be secured through authentication mechanisms or access control lists that prevent unauthenticated access. Additionally, organizations should implement network segmentation and outbound traffic filtering to limit the potential impact of such vulnerabilities by restricting the ability of compromised systems to communicate with internal services or cloud metadata endpoints. Regular security testing including penetration testing and vulnerability scanning should be conducted to identify and remediate similar issues in other application components.