Server-Side Request Forgery Vulnerability in Keeper.sh Calendar Module

CVE-2026-75583

What is CVE-2026-75583?

The calendar module of Keeper.sh prior to version 2.18.14 contains a significant server-side request forgery (SSRF) guard bypass vulnerability. Authenticated attackers can exploit this flaw through a DNS rebinding attack, allowing unauthorized access to private network addresses. This occurs because the SSRF guard incorrectly processes hostname resolution during the validation phase, failing to prevent a potential attack when the actual connection is established. By manipulating DNS responses, an attacker can redirect requests to sensitive internal resources, such as cloud instance metadata endpoints, posing a critical risk to the internal infrastructure.

References