A critical server-side request forgery flaw in the Keep alerting platform lets unauthenticated attackers coerce the backend into issuing arbitrary HTTP requests, exposing internal services and cloud credentials.
What Is It
CVE-2026-65057 is an unauthenticated server-side request forgery (SSRF) vulnerability (CWE-918) in Keep, the open-source project maintained by keephq. In the affected code (commit 91c75e0), the healthcheck endpoint is unprotected and accepts attacker-controlled host values. By sending a crafted JSON payload with a malicious host parameter, an attacker can make the backend issue outbound HTTP requests to destinations of their choosing.
Why It Matters
The vulnerability carries a CVSS 3.1 base score of 9.3 (CRITICAL), with a network attack vector, low attack complexity, no privileges required, and no user interaction. The scope is CHANGED with HIGH confidentiality impact. Because it is unauthenticated and network-reachable, attackers can direct the backend at internal services or cloud metadata endpoints; enabling theft of cloud credentials and internal network reconnaissance. A secondary CVSS 4.0 score of 9.2 (CRITICAL) reinforces the severity.
What's Vulnerable
- Vendor: keephq
- Product: Keep
- Affected version: git builds up to and including commit 91c75e0 (default status: affected)
The exposure is the unprotected POST providers healthcheck endpoint, which processes untrusted host values without restriction.
Patch Status
The supplied NVD record (status: Received) does not list a fixed version or a specific patched commit, and no CISA KEV entry accompanies this data, so there is no confirmation of active exploitation or a mandated remediation deadline. Organizations running Keep should track the vendor's GitHub issue (#6630) and the VulnCheck advisory below for remediation guidance and monitor for a patched release beyond commit 91c75e0.