Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-65057

Keep Unauthenticated Server-Side Request Forgery via POST /providers/healthcheck

CVSS 4.0 9.2 CRITICALCVSS 3.1 9.3 CRITICALCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-65057

Published

Keep (commit 91c75e0) contains a server-side request forgery vulnerability that allows unauthenticated attackers to make the backend issue arbitrary HTTP requests by supplying attacker-controlled host values to the unprotected healthcheck endpoint. Attackers can send a crafted JSON payload with a malicious host parameter to cause the backend to issue outbound requests to internal services or cloud metadata endpoints, enabling theft of cloud credentials and internal network reconnaissance.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-65057

Published

keep

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "defaultStatus": "affected",
                    "vendor": "keephq",
                    "product": "keep",
                    "versions": [
                        {
                            "status": "affected",
                            "version": "0",
                            "versionType": "git",
                            "lessThanOrEqual": "91c75e0"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON