CVE-2026-75583 is an SSRF guard bypass vulnerability in keeper.sh's calendar module before version 2.18.14. The vulnerability arises because the SSRF guard validates the hostname's resolved IP addresses but discards them before opening the HTTP connection. An attacker controlling authoritative DNS can return a public IP during validation and a private IP during the actual socket-level DNS resolution, allowing the attacker to reach internal infrastructure such as cloud instance metadata endpoints despite the SSRF protections.

Authenticated attackers can exploit this vulnerability to access internal network resources that should be protected by SSRF guards, potentially exposing sensitive internal endpoints like cloud instance metadata services. The CVSS score is low (2.3), indicating limited impact or exploitability conditions such as requiring authentication and high attack complexity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the calendar module to trusted users and monitor for suspicious DNS rebinding activity. Avoid relying solely on hostname validation for SSRF protection.