keeper.sh CVE-2026-75583

Exploitation requires: (1) a valid authenticated account on the keeper.sh instance (PR:L) with permission to configure ICS subscription or CalDAV server URLs; (2) control over authoritative DNS for the hostname supplied in the calendar URL, enabling the attacker to manipulate TTL and response timing to achieve rebinding; (3) the target keeper.sh instance must be making outbound HTTP requests to attacker-controlled domains - this is the default behavior of ICS/CalDAV subscriptions. Exploitation is limited by: high attack complexity due to DNS rebinding timing requirements; the fact that BLOCK_PRIVATE_RESOLUTION=true (if set) blocks the attack entirely; self-hosted deployments with strict egress firewall rules preventing outbound connections to RFC 1918/169.254.x.x ranges are not exploitable via the network path. Cloud-hosted deployments without IMDSv2 hop-count enforcement face the highest realistic risk.

The CVSS 4.0 base score of 2.3 reflects the constrained real-world exploitability accurately. Attack Complexity is High (AC:H) because successful exploitation requires the attacker to control authoritative DNS for the target hostname - a non-trivial prerequisite that limits opportunistic mass exploitation. Authentication is required (PR:L), restricting the attack surface to users with valid calendar accounts who can configure ICS or CalDAV subscription URLs. The confidentiality impact is bounded at Low for both the vulnerable system (VC:L) and subsequent systems (SC:L), meaning the attacker can probe and potentially read data from internal endpoints such as cloud IMDS, but cannot write or cause availability disruption. No KEV listing and no identified public exploit code further lower urgency. The primary real-world risk is credential or token harvesting from cloud metadata services (e.g., AWS IMDSv1 without hop-limit hardening) in cloud-hosted deployments. Self-hosted instances on isolated networks face reduced risk. This is a genuine SSRF flaw but a niche product with limited deployment scale, high attack complexity, and a narrow confidentiality-only impact - treat as medium internal priority rather than emergency.

An authenticated keeper.sh user configures a malicious ICS subscription URL pointing to a domain they control. Their DNS server returns a public routable IP during the SSRF guard's validation phase, causing validation to pass, then immediately switches the DNS response to 169.254.169.254 (AWS instance metadata) for the actual HTTP connection, allowing the calendar module to fetch and return cloud credential metadata to the attacker. No public exploit code has been identified, but the technique is a well-understood DNS rebinding pattern requiring only DNS authority over the target domain.