{"id":"CVE-2026-75583","title":"keeper.sh's calendar module version prior to 2.18.14 contains a server-side request forgery (SSRF) guard bypass vulnerability that allows authenticated attackers to reach private network addresses by exploiting a DNS rebinding attack aga…","summary":"keeper.sh's calendar module version prior to 2.18.14 contains a server-side request forgery (SSRF) guard bypass vulnerability that allows authenticated attackers to reach private network addresses by exploiting a DNS rebinding attack aga…","severity":"low","cvss":3.5,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N","cwe":["CWE-918"],"published":"2026-08-19","updated":"2026-09-24","sourceUpdated":"2026-09-24T20:06:30.133","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-75583","references":[{"url":"https://github.com/ridafkih/keeper.sh","label":"disclosure@vulncheck.com"},{"url":"https://github.com/ridafkih/keeper.sh/commit/aea1cf537b850509e802b388f38cf1482cb6291b","label":"disclosure@vulncheck.com"},{"url":"https://github.com/ridafkih/keeper.sh/security/advisories/GHSA-mxxg-qffg-j3p6","label":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/keeper-sh-calendar-version-prior-to-ssrf-guard-bypass-via-dns-rebinding","label":"disclosure@vulncheck.com"}],"tags":["nvd"],"epss":0.00325,"epssPercentile":0.22838,"ingestedAt":"2026-09-24T20:51:40.209Z","slug":"CVE-2026-75583","body":"## Overview\n\nkeeper.sh's calendar module version prior to 2.18.14 contains a server-side request forgery (SSRF) guard bypass vulnerability that allows authenticated attackers to reach private network addresses by exploiting a DNS rebinding attack against the two-phase URL validation and connection flow. The SSRF guard validates a hostname's resolved IP addresses but discards them before the actual HTTP connection is opened, allowing an attacker who controls authoritative DNS to return a public address during validation and a private address during the subsequent independent socket-level DNS resolution, causing the guard to pass while the outbound connection reaches internal infrastructure such as cloud instance metadata endpoints.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":19,"depthScoreParts":{"impact":19.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}