Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-75583— keeper.sh Calendar version prior to 2.18.14 SSRF Guard Bypass via DNS Rebinding

Quick assessment

Affected
ridafkih keeper.sh
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 keeper.sh 的日历模块中，2.18.14 之前的版本存在一个服务端请求伪造（SSRF）防护绕过漏洞。该漏洞允许经过身份验证的攻击者通过利用针对两阶段 URL 验证和连接流程的 DNS 重绑定攻击，访问私有网络地址。SSRF 防护机制在验证主机名解析后的 IP 地址后会将其丢弃，然后在实际建立 HTTP 连接之前不再生效。这使得攻击者可以在验证阶段返回一个公网地址，而在后续独立的基于套接字的 DNS 解析阶段返回一个私有地址，从而导致防护机制被绕过， outbound 连接最终到达内部基础设施，例如云实例

CVSS 3.5 · Low EPSS 0.20% · P11

Affected Version Matrix 1

VendorProduct Version RangeStatus
ridafkih keeper.sh < 2.18.14 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-75583

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
keeper.sh Calendar version prior to 2.18.14 SSRF Guard Bypass via DNS Rebinding
Source: CVE Program / CVE List V5
Vulnerability Description
keeper.sh's calendar module version prior to 2.18.14 contains a server-side request forgery (SSRF) guard bypass vulnerability that allows authenticated attackers to reach private network addresses by exploiting a DNS rebinding attack against the two-phase URL validation and connection flow. The SSRF guard validates a hostname's resolved IP addresses but discards them before the actual HTTP connection is opened, allowing an attacker who controls authoritative DNS to return a public address during validation and a private address during the subsequent independent socket-level DNS resolution, causing the guard to pass while the outbound connection reaches internal infrastructure such as cloud instance metadata endpoints.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
服务端请求伪造(SSRF)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
ridafkih keeper.sh 0 ~ 2.18.14 -

II. Public POCs for CVE-2026-75583

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-75583

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-75583 (2)

IV. Related Vulnerabilities

Same weakness: CWE-918

V. Comments for CVE-2026-75583

No comments yet

Leave a comment