CVE-2026-65057
A server-side request forgery flaw in the Keep healthcheck endpoint lets attackers send arbitrary HTTP requests from the backend. The vulnerability is exploitable without authentication and can target internal services or cloud metadata endpoints.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Any deployment of Keep that includes the unprotected healthcheck endpoint; no specific product versions are listed in the data.
Real-world impact
An attacker can trick the server into reaching internal resources or cloud metadata services, potentially stealing credentials or mapping the internal network.
Why this severity
The CVSS score of 9.2 reflects the high impact on confidentiality (potential credential theft), the low attack complexity, and the fact that no authentication or user interaction is required.
What to do about it
- ›Restrict or disable access to the healthcheck endpoint so only trusted hosts can reach it.
- ›Block outbound traffic from the backend to internal services or cloud metadata endpoints unless explicitly required.
- ›Monitor logs for unexpected outbound requests and investigate any anomalies promptly.
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources