by Kastro
Paper/Archive/CVE-2026-65057

CVE-2026-65057

keephq keep — Keep Unauthenticated Server-Side Request Forgery via POST /providers/healthcheck

EPSS 0.3%public exploitCVSS 9.3
critical.is priorityof 100
43
CVSS 9.3 (CNA)9.3 / 10 × 3027.9Not in CISA KEV+300.0EPSS percentile 24.4.244 × 204.9Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

Keep (commit 91c75e0) contains a server-side request forgery vulnerability that allows unauthenticated attackers to make the backend issue arbitrary HTTP requests by supplying attacker-controlled host values to the unprotected healthcheck endpoint. Attackers can send a crafted JSON payload with a malicious host parameter to cause the backend to issue outbound requests to internal services or cloud metadata endpoints, enabling theft of cloud credentials and internal network reconnaissance.

Affected

ProductAffectedFixed inSource
keep≤ 91c75e0–CNA

Scores by source

VulnCheck (CNA)9.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N
VulnCheck (CNA)9.2CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: partial

References

exploitgithub.com/keephq/keep/issues/6630patchgithub.com/keephq/keepwriteupvulncheck.com/advisories/keep-unauthenticated-server-side-request-forgery-via-post-providers-healthcheck