CVE-2026-75583
Received Received - Intake

SSRF Guard Bypass in keeper.sh Calendar Module

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: VulnCheck

Description
keeper.sh's calendar module version prior to 2.18.14 contains a server-side request forgery (SSRF) guard bypass vulnerability that allows authenticated attackers to reach private network addresses by exploiting a DNS rebinding attack against the two-phase URL validation and connection flow. The SSRF guard validates a hostname's resolved IP addresses but discards them before the actual HTTP connection is opened, allowing an attacker who controls authoritative DNS to return a public address during validation and a private address during the subsequent independent socket-level DNS resolution, causing the guard to pass while the outbound connection reaches internal infrastructure such as cloud instance metadata endpoints.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-19
Last Modified
2026-08-19
Generated
2026-08-19
AI Q&A
2026-08-19
EPSS Evaluated
N/A
NVD
CVE-2026-75583
EUVD
EUVD-2026-62585

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
keeper.sh calendar_module to 2.18.14 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a DNS rebinding vulnerability in keeper.sh's calendar module before version 2.18.14. It bypasses SSRF protections by exploiting a two-phase URL validation process. The SSRF guard checks a hostname's IP addresses but discards them before the actual connection. An attacker controlling DNS can return a public IP during validation and a private IP during the connection phase, allowing access to internal networks like cloud metadata endpoints.

Detection Guidance

To detect this vulnerability, monitor outbound HTTP/HTTPS connections from keeper.sh instances to private network addresses. Check DNS logs for unusual DNS rebinding patterns where a hostname resolves to different IPs during validation and connection phases. Inspect network traffic for requests to cloud instance metadata endpoints or other internal infrastructure from keeper.sh processes.

Impact Analysis

Authenticated attackers could exploit this to make the server send HTTP/HTTPS requests to private network addresses. This could expose internal cloud infrastructure, metadata endpoints, or other sensitive services. The impact is limited by network configuration but could lead to unauthorized access or data leakage if internal services are vulnerable.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by allowing unauthorized access to private network addresses, which may include sensitive data or systems handling personal or protected health information. SSRF vulnerabilities like this can lead to data breaches or unauthorized data exfiltration, violating confidentiality requirements under these regulations.

Mitigation Strategies

Upgrade keeper.sh to version 2.18.14 or later immediately. As a temporary measure, restrict egress traffic from application containers and enforce IMDSv2 on cloud hosts. Disable BLOCK_PRIVATE_RESOLUTION if not strictly necessary and ensure hostnames are in the PRIVATE_RESOLUTION_WHITELIST if they must access private addresses.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-75583. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart