Attack Chain

1. An unauthenticated attacker identifies a vulnerable instance of Keep (commit 91c75e0) exposed to the internet.
2. The attacker crafts a malicious JSON payload containing a host parameter with a value pointing to an internal service IP address (e.g., 10.0.0.1) or a cloud metadata service endpoint (e.g., 169.254.169.254/latest/meta-data).
3. The attacker sends this crafted JSON payload as an HTTP request to the unprotected /healthcheck endpoint of the vulnerable Keep application.
4. The Keep backend processes the request, and due to the SSRF vulnerability, it initiates an arbitrary outbound HTTP request using the attacker-controlled host value.
5. The backend application attempts to connect to the specified internal service or cloud metadata endpoint, fetching its response.
6. The response from the internal service or metadata endpoint is returned to the attacker through the vulnerable Keep application, enabling internal network reconnaissance by mapping reachable services.
7. If targeting cloud metadata services, the attacker extracts temporary cloud credentials, API keys, or other sensitive configuration data from the responses.
8. The attacker can then use the stolen cloud credentials to gain unauthorized access to cloud resources and further compromise the environment.

Impact

Successful exploitation of CVE-2026-65057 can lead to severe consequences for organizations utilizing the affected Keep software. Attackers can perform extensive internal network reconnaissance, mapping out private network segments and identifying other vulnerable systems or services that are typically not exposed externally. The most critical impact is the potential theft of cloud credentials from metadata services, granting attackers unauthorized access to an organization's cloud environment. This could result in data exfiltration, service disruption, or further lateral movement within cloud infrastructure, leading to significant financial and reputational damage.

Recommendation

• Patch CVE-2026-65057 immediately by updating Keep to a patched version beyond commit 91c75e0, if available, or applying vendor-provided mitigation steps.
• Deploy the Sigma rule "Detect CVE-2026-65057 Exploitation - Keep SSRF Attempt" to your SIEM to detect attempts to exploit the /healthcheck endpoint using internal IP addresses or cloud metadata service hostnames.
• Enable comprehensive web server logging for the webserver category to ensure cs-uri-stem and cs-uri-query fields are captured, which are crucial for the detection rule.
• Implement strict network segmentation and egress filtering to prevent internal systems from making arbitrary outbound connections, especially to private IP ranges or metadata service IPs, even if a server-side application is compromised.