EUVD-2026-62585Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network vector with high complexity for DNS rebinding; authenticated attacker required; scope changes to internal systems with limited confidentiality read impact only.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
keeper.sh's calendar module version prior to 2.18.14 contains a server-side request forgery (SSRF) guard bypass vulnerability that allows authenticated attackers to reach private network addresses by exploiting a DNS rebinding attack against the two-phase URL validation and connection flow. The SSRF guard validates a hostname's resolved IP addresses but discards them before the actual HTTP connection is opened, allowing an attacker who controls authoritative DNS to return a public address during validation and a private address during the subsequent independent socket-level DNS resolution, causing the guard to pass while the outbound connection reaches internal infrastructure such as cloud instance metadata endpoints.
AnalysisAI
DNS rebinding in keeper.sh's calendar module (versions prior to 2.18.14) allows authenticated attackers to bypass the SSRF guard and route outbound HTTP connections to private network addresses, including cloud instance metadata endpoints such as 169.254.169.254. The flaw arises from a two-phase design: the guard resolves a hostname's IP addresses, asserts they are public, then discards those resolved addresses before independently re-resolving the hostname at socket-open time - an attacker controlling authoritative DNS can serve a public IP during validation and swap it to a private IP for the subsequent connection. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires: (1) a valid authenticated account on the keeper.sh instance (PR:L) with permission to configure ICS subscription or CalDAV server URLs; (2) control over authoritative DNS for the hostname supplied in the calendar URL, enabling the attacker to manipulate TTL and response timing to achieve rebinding; (3) the target keeper.sh instance must be making outbound HTTP requests to attacker-controlled domains - this is the default behavior of ICS/CalDAV subscriptions. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 base score of 2.3 reflects the constrained real-world exploitability accurately. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An authenticated keeper.sh user configures a malicious ICS subscription URL pointing to a domain they control. Their DNS server returns a public routable IP during the SSRF guard's validation phase, causing validation to pass, then immediately switches the DNS response to 169.254.169.254 (AWS instance metadata) for the actual HTTP connection, allowing the calendar module to fetch and return cloud credential metadata to the attacker. … |
| Remediation | Upgrade keeper.sh to version 2.18.14 or later, which incorporates the fix from commit aea1cf537b850509e802b388f38cf1482cb6291b. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today