CVE-2026-75583 ridafkih CVE debrief

Who should care

Defenders responsible for keeper.sh calendar module deployments should assess exposure and verify the effectiveness of current SSRF guards. They should prioritize verifying exposure of keeper.sh calendar module versions prior to 2.18.14 and assessing the effectiveness of current SSRF guards. This includes reviewing compensating controls for exposed systems and monitoring for potential exploitation attempts.

Why it matters

CVE-2026-75583 is a server-side request forgery (SSRF) guard bypass vulnerability in keeper.sh's calendar module version prior to 2.18.14. Authenticated attackers can exploit a DNS rebinding attack to reach private network addresses. Defenders should prioritize verifying exposure and assessing the effectiveness of current SSRF guards.

• Potential exposure of private network addresses
• Bypass of SSRF guards via DNS rebinding attack
• Verification of keeper.sh calendar module versions and SSRF guard effectiveness

Technical summary

The SSRF guard in keeper.sh's calendar module version prior to 2.18.14 is vulnerable to a DNS rebinding attack, allowing authenticated attackers to reach private network addresses by exploiting the two-phase URL validation and connection flow. The guard validates a hostname's resolved IP addresses but discards them before the actual HTTP connection is opened, allowing an attacker who controls authoritative DNS to return a public address during validation and a private address during the subsequent independent socket-level DNS resolution.

Defensive priority

Defenders should prioritize verifying exposure of keeper.sh calendar module versions prior to 2.18.14 and assessing the effectiveness of current SSRF guards.

Recommended defensive actions

• Verify keeper.sh calendar module versions and assess exposure
• Evaluate the effectiveness of current SSRF guards
• Monitor for potential exploitation attempts
• Perform additional verification tasks to confirm exposure
• Validate the effectiveness of SSRF guards
• Review compensating controls for exposed systems
• Track exceptions and retest remediated assets

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but the actual impact and affected versions require verification from the official sources. Defenders should verify keeper.sh calendar module versions prior to 2.18.14 and assess the effectiveness of current SSRF guards. Evidence from official sources is limited, so defenders must perform additional verification tasks to confirm exposure and validate the effectiveness of SSRF guards.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.