Which versions of Keep are affected by CVE-2026-65057?

Keep (keephq/keep) contains a critical vulnerability (CVSS 9.2) that allows unauthenticated attackers to steal cloud credentials and access internal infrastructure.. A patch is available.

How to fix or mitigate CVE-2026-65057?

Within 24 hours, identify all Keep deployments and firewall or network-isolate the unauthenticated /providers/healthcheck endpoint to block external access while remediation is prepared. Within 7 days, apply the vendor-released patch to all Keep instances per the vendor advisory. Within 30 days, conduct a security review of cloud credential access logs to identify any unauthorized requests to internal metadata endpoints, validate patch deployment across all production and non-production Keep instances, and document the remediation outcome.

Keep CVE-2026-65057

Q: What is the CVSS score of CVE-2026-65057?

CVE-2026-65057 has a CVSS 4.0 base score of 9.2 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-46427 CRITICAL

Server-Side Request Forgery (SSRF) (CWE-918)

2026-07-21 VulnCheck

GHSA-xhrh-vggg-q3rj

SSRF Keep

9.2

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

9.2 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulnCheck) · only source for this CVE.

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 21:38 vuln.today

CVE Published

Jul 21, 2026 - 20:56 cve.org

CRITICAL 9.2

DescriptionCVE.org

Keep (commit 91c75e0) contains a server-side request forgery vulnerability that allows unauthenticated attackers to make the backend issue arbitrary HTTP requests by supplying attacker-controlled host values to the unprotected healthcheck endpoint. Attackers can send a crafted JSON payload with a malicious host parameter to cause the backend to issue outbound requests to internal services or cloud metadata endpoints, enabling theft of cloud credentials and internal network reconnaissance.

AnalysisAI

Server-side request forgery in Keep (keephq/keep) as of commit 91c75e0 lets unauthenticated attackers coerce the backend into issuing arbitrary outbound HTTP requests by POSTing a crafted host value to an unprotected providers healthcheck endpoint. Because the endpoint requires no authentication, a remote attacker can pivot into internal services and cloud metadata endpoints (e.g. 169.254.169.254) to steal cloud credentials and map internal networks. No public exploit identified at time of analysis, though the flaw was reported by VulnCheck and a corresponding GitHub issue is public; the CVSS 4.0 base score is 9.2 (Critical).