Karakeep versions older than 0.32.0 suffer from a Server‑Side Request Forgery bypass that allows an authenticated user to craft a chain of HTTP redirects. This chain can redirect the application’s internal request mechanism to internal or private network addresses, enabling the attacker to reach services that are otherwise unreachable, potentially exposing sensitive data or creating a pivot point for further attacks. The weakness is a classic SSRF scenario (CWE‑918).

Karakeep application, all installations running any version prior to 0.32.0.

The vulnerability has a CVSS score of 7.6. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated user who can influence redirect chains; the attacker can trigger internal requests to Docker network services that the application can access. Because the application enforces internal‑network protections that are bypassed via redirects, the attack vector is actively exploitable in the context described.