External risk intelligence

Keep Server-Side Request Forgery via Healthcheck Endpoint

CVE advisorySeverity: CRITICAL (CVSS 9.2)

CVE-2026-65057

The vulnerability exists in an unauthenticated healthcheck endpoint of a web application. Such endpoints are typically exposed to the network to allow monitoring services or load balancers to verify service availability, making it likely that this interface is reachable from the internet or the network edge in common deployment scenarios.

Server-Side Request Forgery

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability exists in the Keep application, specifically within its healthcheck endpoint. This flaw allows unauthenticated attackers to manipulate backend requests, potentially leading to the theft of cloud credentials and internal network reconnaissance. The primary concern at this time is confirming whether this specific technology is in use within our environment and assessing the potential exposure.

Backend request manipulation.
Potential cloud credential theft.
Confirm relevance and exposure.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by sending a specially crafted JSON request to an exposed health check endpoint. This request contains an attacker-controlled host value, which the backend then uses to issue an arbitrary HTTP request. This can allow the attacker to access internal services or cloud metadata endpoints.

Unauthenticated network access to healthcheck endpoint.
Crafting JSON payload with malicious host parameter.
Internal reconnaissance and credential theft.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to trick the backend into issuing arbitrary HTTP requests by manipulating the `host` parameter in the `healthcheck` endpoint. This could lead to the exposure of internal services or cloud metadata, potentially enabling the theft of cloud credentials or mapping of the internal network.

Internal network services and cloud credentials at risk.
Attacker sends crafted JSON to unprotected endpoint.
Credential theft and network reconnaissance possible.

Operational Fix

Recommended remediation, mitigation, and detection steps

Server-side request forgery in an unauthenticated healthcheck endpoint means that infrastructure or platform teams are likely responsible for identifying and securing this component. The first step is to locate all instances of the affected technology, determine their exposure and criticality, and then assign ownership for remediation planning.

Identify and assess affected systems.
Verify network exposure and business criticality.
Plan remediation with accountable owners.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Keep software?

Keep is an open-source alert management and incident response platform designed to help teams consolidate alerts from various sources. It acts as a central hub for monitoring workflows, meaning it is often deeply integrated with cloud environments and internal infrastructure to pull data and trigger actions based on system performance.

How does CVE-2026-65057 work?

This vulnerability is a Server-Side Request Forgery (SSRF), classified as CWE-918. It happens when an application fails to validate user input before using it to make network requests. In this case, the Keep application's healthcheck endpoint allows an attacker to supply a custom host value. The server then blindly forwards an HTTP request to that address, essentially acting as a proxy for the attacker to reach restricted destinations.

What triggers this SSRF vulnerability?

An attacker triggers the flaw by sending a specially crafted JSON payload to the application's healthcheck endpoint. Because the endpoint does not require authentication, anyone with network access to the endpoint can send this request. Simple, non-malicious traffic or standard monitoring pings that do not include a modified host parameter will not trigger this vulnerability.

Is my instance at risk according to Halo Surface Signal?

Halo Surface Signal notes that because this flaw resides in a healthcheck endpoint—which is often intentionally exposed to the network so load balancers or monitors can verify service availability—it is highly likely to be reachable from the internet or the network edge. If your Keep instance is accessible to the public internet, it faces a higher degree of risk from external actors.

How do I respond to this threat?

First, conduct an internal audit to inventory every instance of Keep currently running in your environment. Once identified, evaluate whether these instances are exposed to untrusted networks. If they are, prioritize restricting network access or isolating the affected endpoints while you coordinate with your infrastructure team to implement the necessary security updates.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.