CVE-2026-75583 in keeper.sh
Summary
by MITRE • 08/19/2026
keeper.sh's calendar module version prior to 2.18.14 contains a server-side request forgery (SSRF) guard bypass vulnerability that allows authenticated attackers to reach private network addresses by exploiting a DNS rebinding attack against the two-phase URL validation and connection flow. The SSRF guard validates a hostname's resolved IP addresses but discards them before the actual HTTP connection is opened, allowing an attacker who controls authoritative DNS to return a public address during validation and a private address during the subsequent independent socket-level DNS resolution, causing the guard to pass while the outbound connection reaches internal infrastructure such as cloud instance metadata endpoints.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/19/2026
The vulnerability identified in keeper.sh's calendar module prior to version 2.18.14 represents a critical server-side request forgery (SSRF) flaw rooted in an insecure implementation of URL validation logic. This specific weakness allows authenticated attackers to bypass security controls designed to restrict outbound network connections, thereby enabling access to internal private network addresses that should otherwise be inaccessible from the application layer. The core technical issue lies within the two-phase process used for validating and establishing HTTP connections. During the initial phase, the SSRF guard performs a DNS resolution on the target hostname to verify whether the resolved IP address falls within an allowed public range or is blocked as private. However, this validation step operates independently of the actual socket-level connection establishment that follows in the second phase. This architectural separation creates a race condition-like scenario where the security check and the network action are not atomic, allowing for manipulation through DNS rebinding techniques.
The exploitation mechanism relies heavily on the attacker's ability to control or influence authoritative DNS responses. By leveraging a DNS rebinding attack, an adversary can configure their domain to return different IP addresses depending on when the query is made. During the initial validation phase triggered by the SSRF guard, the attacker’s server returns a public IP address that passes the security filter. Subsequently, before the application initiates the actual HTTP connection using standard socket APIs, the DNS resolver performs another independent resolution for the same hostname. At this later stage, the authoritative DNS response is altered to return a private or internal IP address, such as those found in RFC 1918 ranges (e.g., 10.x.x.x, 172.16-31.x.x) or cloud metadata endpoints like AWS EC2 instance metadata service at 169.254.169.254. Because the initial validation has already passed and discarded its resolved IP data without caching it for use in the connection phase, the subsequent socket-level resolution proceeds with the private address unimpeded by the SSRF guard. This effectively nullifies the protective measure intended to prevent internal network reconnaissance or exploitation of backend services.
The operational impact of this vulnerability is severe, particularly in environments where the application has access to sensitive internal infrastructure. Successful exploitation allows an authenticated user to pivot from a web-facing service into the private network segment. Attackers can target cloud instance metadata endpoints to steal temporary credentials, IAM roles, and other highly sensitive configuration data that are often exposed without authentication on local loopback or link-local addresses. Beyond credential theft, this SSRF capability facilitates broader internal network mapping, allowing attackers to probe for vulnerable services running on internal ports, such as databases, administrative panels, or legacy applications that lack external-facing security controls. The presence of an authenticated requirement means the attack surface is limited to valid users, but given that many enterprise systems suffer from weak authentication hygiene or account compromise via phishing, this remains a significant risk vector for lateral movement and data exfiltration within cloud-native architectures.
From a classification perspective, this vulnerability aligns with CWE-918 Server-Side Request Forgery (SSRF), specifically illustrating the sub-category of SSRF through DNS rebinding where validation logic is decoupled from execution context. It also maps to MITRE ATT&CK technique T1557.002 Adversary-in-the-Middle, as the attacker intercepts and manipulates network trust relationships via DNS manipulation to facilitate unauthorized access. Furthermore, it relates to CWE-643 Improper Mitigation of SSRF Vulnerabilities in Web Application Frameworks due to the failure to ensure that validation checks are applied atomically with respect to resource acquisition. The flaw underscores a common pitfall in web application development where developers assume that validating input at one stage guarantees safety throughout the entire request lifecycle, neglecting the stateless and potentially mutable nature of DNS resolution mechanisms.
To mitigate this vulnerability, immediate remediation requires upgrading keeper.sh's calendar module to version 2.18.14 or later, which presumably addresses the timing gap between validation and connection establishment. In scenarios where an upgrade is not immediately feasible, defensive measures should focus on enforcing strict egress filtering at the network perimeter using firewalls that block outbound connections to private IP ranges from application servers. Additionally, implementing DNS resolution caching with a short TTL can reduce the window of opportunity for rebinding attacks, although this alone may not be sufficient if the validation and connection phases are still separated in code logic. Application-level mitigations include ensuring that SSRF guards perform final IP verification immediately before or during socket creation rather than relying on pre-validation results. Developers should also consider using libraries that abstract DNS resolution to ensure consistency between validation and execution, or explicitly resolve hostnames once at the start of a request session and reuse those specific IPs for all subsequent operations within that context. Regular security audits focusing on network egress policies and SSRF prevention patterns are essential to maintain robust defense-in-depth strategies against such sophisticated bypass techniques.