Executive brief
keeper.sh is a calendar synchronization and management tool that aggregates calendars from multiple providers (Google, Outlook, Office 365, iCloud, CalDAV). The vulnerability allows authenticated attackers to bypass security controls that prevent connections to internal networks, potentially exposing sensitive data from cloud infrastructure such as metadata endpoints that contain credentials and configuration information.
Technical details
The calendar module contains a server-side request forgery (SSRF) guard bypass vulnerability in DNS validation (CVE-2026-75583). The guard validates hostnames by resolving them to IP addresses but discards the results before making the actual HTTP connection, allowing a two-stage attack: the attacker controls DNS to return a public IP during validation (bypassing the guard) and a private IP during the actual socket-level DNS resolution. This permits attackers to reach cloud metadata endpoints and other internal infrastructure. The vulnerability requires authentication but can be exploited by anyone with valid application access. A fix is available in version 2.18.14 and later.
Affected products
- ridafkih keeper.sh prior to 2.18.14
Timeline
- 2026-08-19: disclosed
- 2.18.14: patched: Fix released in version 2.18.14 via commit aea1cf5