The vulnerability in keeper.sh's calendar module (versions before 2.18.14) involves an SSRF guard bypass via DNS rebinding. The SSRF guard validates hostnames by resolving IP addresses but discards these results before opening the HTTP connection. An attacker controlling authoritative DNS can return a public IP during validation and a private IP during the actual connection, causing the guard to incorrectly allow the request. This enables access to internal infrastructure endpoints that should be protected.

An authenticated attacker with low privileges can exploit this vulnerability to access internal network resources that are normally protected by SSRF guards. This includes sensitive endpoints such as cloud instance metadata services. The impact is limited by the requirement for authentication and the low severity rating, indicating limited potential for widespread or critical damage.

A fixed version 2.18.14 or later should be applied to remediate this vulnerability. Since no patch links or vendor advisories are provided, verify with the vendor for official fixes. Until patched, restrict authenticated user capabilities and monitor for suspicious DNS rebinding activity. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.