PT-2026-62119 · Keephq · Keep

George Chen · CVE-2026-65057 · Published 2026-07-21 · Updated 2026-07-21

NVD

CVSS v3.1

9.3

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N

Keep (commit 91c75e0) contains a server-side request forgery vulnerability that allows unauthenticated attackers to make the backend issue arbitrary HTTP requests by supplying attacker-controlled host values to the unprotected healthcheck endpoint. Attackers can send a crafted JSON payload with a malicious host parameter to cause the backend to issue outbound requests to internal services or cloud metadata endpoints, enabling theft of cloud credentials and internal network reconnaissance.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-65057

Affected Products

Keep

References · 4

• https://github.com/keephq/keep · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-65057 · Security Note
• https://github.com/keephq/keep/issues/6630 · Note
• https://vulncheck.com/advisories/keep-unauthenticated-server-side-request-forgery-via-post-providers-healthcheck · Note