PT-2026-62119 · Keephq · Keep

George Chen · CVE-2026-65057 · Publicado 2026-07-21 · Atualizado 2026-07-21

NVD

CVSS v3.1

9.3

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N

Keep (commit 91c75e0) contains a server-side request forgery vulnerability that allows unauthenticated attackers to make the backend issue arbitrary HTTP requests by supplying attacker-controlled host values to the unprotected healthcheck endpoint. Attackers can send a crafted JSON payload with a malicious host parameter to cause the backend to issue outbound requests to internal services or cloud metadata endpoints, enabling theft of cloud credentials and internal network reconnaissance.

Correção

SSRF

Enumeração de Fraquezas

CWE-918

Identificadores relacionados

CVE-2026-65057

Produtos afetados

Keep

Referências · 4

• https://github.com/keephq/keep · Correção
• https://github.com/keephq/keep/issues/6630 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-65057 · Nota de Segurança
• https://vulncheck.com/advisories/keep-unauthenticated-server-side-request-forgery-via-post-providers-healthcheck · Nota