CVE-2026-75583 - keeper.sh Calendar version prior to 2.18.14 SSRF Guard Bypass via DNS Rebinding
Brief
CVE ID : CVE-2026-75583
Published : Aug. 19, 2026, 4:35 p. m.
- 33 minutes ago
Description : keeper. sh's calendar module version prior to 2.
- 14 contains a server-side request forgery (SSRF) guard bypass vulnerability that allows authenticated attackers to reach private network addresses by exploiting a DNS rebinding attack against the two-phase URL validation and connection flow.
The SSRF guard validates a hostname's resolved IP addresses but discards them before the actual HTTP connection is opened, allowing an attacker who controls authoritative DNS to return a public address during validation and a private address during the subsequent independent socket-level DNS resolution, causing the guard to pass while the outbound connection reaches internal infrastructure such as cloud instance metadata endpoints.