CVE-2026-65057 is a server-side request forgery vulnerability in the Keep application at commit 91c75e0. The vulnerability exists because the healthcheck endpoint does not properly restrict or validate host parameters supplied in JSON payloads. An attacker can send crafted requests with attacker-controlled host values, causing the backend server to issue arbitrary HTTP requests to internal or cloud metadata services. This can expose sensitive information such as cloud credentials and enable internal network mapping. The vulnerability is unauthenticated and remotely exploitable with a CVSS 9.2 rating, indicating critical severity. No official patch or remediation guidance is currently available, and no known exploits in the wild have been reported.

Successful exploitation allows unauthenticated attackers to make the backend server perform arbitrary HTTP requests, potentially accessing internal network resources and cloud metadata endpoints. This can lead to theft of cloud credentials and internal network reconnaissance, posing a significant risk to confidentiality and security of the affected environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the healthcheck endpoint and implement network-level controls to prevent the backend from making unauthorized outbound requests to sensitive internal or cloud metadata services.