CVE-2026-65057 | BDVDB-2026-351601 Detail

Description#

Keep (commit 91c75e0) contains a server-side request forgery vulnerability that allows unauthenticated attackers to make the backend issue arbitrary HTTP requests by supplying attacker-controlled host values to the unprotected healthcheck endpoint. Attackers can send a crafted JSON payload with a malicious host parameter to cause the backend to issue outbound requests to internal services or cloud metadata endpoints, enabling theft of cloud credentials and internal network reconnaissance.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-07-21Record published in the CVE List.
2. Version 22026-09-24Most recent update recorded in the CVE List.