Vulnerability · Published Jul 21, 2026 · Assigned by VulnCheck

CVE-2026-65057Keep Unauthenticated Server-Side Request Forgery via POST /providers/healthcheck

Critical 9.3

In plain English

A critical-severity server-side request forgery in keep from keephq. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 24% of all known vulnerabilities).

Severity (CVSS 3.1)9.3Critical

Exploit odds (30 days)0.3%top 75.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Keep (commit 91c75e0) contains a server-side request forgery vulnerability that allows unauthenticated attackers to make the backend issue arbitrary HTTP requests by supplying attacker-controlled host values to the unprotected healthcheck endpoint. Attackers can send a crafted JSON payload with a malicious host parameter to cause the backend to issue outbound requests to internal services or cloud metadata endpoints, enabling theft of cloud credentials and internal network reconnaissance.

Affected products (as reported)

Vendor	Product	Versions
keephq	keep	0 – through 91c75e0

Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N

References

GitHub Issue issue-tracking
Product patch
https://www.vulncheck.com/advisories/keep-unauthenticated-server-side-request-forgery-via-post-providers-healthcheck third-party-advisory