Server-Side Request Forgery Vulnerability in Keep by KeepHQ
CVE-2026-65057

9.2CRITICAL

Key Information:

Vendor

Keephq

Status
Keep
Vendor
CVE Published:
21 July 2026

What is CVE-2026-65057?

A vulnerability exists within Keep that allows unauthenticated attackers to exploit the unprotected healthcheck endpoint. By manipulating host values, attackers can craft a JSON payload to force the backend into sending arbitrary HTTP requests. This can lead to the exposure of sensitive cloud credentials and unauthorized access to internal services, enhancing the risk of network reconnaissance and potential data breaches.

Affected Version(s)

keep 0 <= 91c75e0

References

https://github.com/keephq/keep/issues/6630
issue-tracking
https://github.com/keephq/keep
patch
https://www.vulncheck.com/advisories/keep-unauthenticated...
third-party-advisory

CVSS V4

Score:
9.2
Severity:
CRITICAL
Confidentiality:
High
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

George Chen
.