{"apiVersion":"1.0","identifier":"CVE-2026-75583","description":"keeper.sh-s calendar module version prior to 2.18.14 contains a server-side request forgery (SSRF) guard bypass vulnerability that allows authenticated attackers to reach private network addresses by exploiting a DNS rebinding attack against the two-phase URL validation and connection flow. The SSRF guard validates a hostname-s resolved IP addresses but discards them before the actual HTTP connection is opened, allowing an attacker who controls authoritative DNS to return a public address during validation and a private address during the subsequent independent socket-level DNS resolution, causing the guard to pass while the outbound connection reaches internal infrastructure such as cloud instance metadata endpoints.","publishedAt":"2026-08-19T17:21:13","lastModifiedAt":"2026-08-19T18:17:26","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-75583","cvssScore":3.5,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N","epssProbability":0.00204,"riskScore":0.36,"affectedProduct":"keeper.sh-s","affectedVersions":"<2.18.14","vulnerabilityType":"Web app","operatingSystems":[],"links":{"self":"https://www.redsauce.net/api/cves/CVE-2026-75583","webPages":{"es":"https://www.redsauce.net/es/cves/CVE-2026-75583","en":"https://www.redsauce.net/en/cves/CVE-2026-75583","fr":"https://www.redsauce.net/fr/cves/CVE-2026-75583","pt":"https://www.redsauce.net/pt/cves/CVE-2026-75583","de":"https://www.redsauce.net/de/cves/CVE-2026-75583","sk":"https://www.redsauce.net/sk/cves/CVE-2026-75583","el":"https://www.redsauce.net/el/cves/CVE-2026-75583"},"source":"https://nvd.nist.gov/vuln/detail/CVE-2026-75583"}}