Keep allows an unauthenticated attacker to control the host field of a POST request to /providers/healthcheck, causing the backend to issue arbitrary outbound HTTP calls. This server‑side request forgery can reach internal services and cloud metadata endpoints, exposing secrets or enabling internal network reconnaissance. The flaw is classified as CWE‑918 and has a CVSS score of 9.2.

The vulnerability affects the Keep application provided by Keephq. No specific product version is listed; the issue exists in the codebase referenced by commit 91c75e0. Organisations deploying this version without authentication controls on the healthcheck endpoint are impacted.

The CVSS score of 9.2 indicates high severity, but the EPSS score of less than 1% suggests that exploitation is currently unlikely. The flaw is not listed in CISA’s KEV catalog. Attackers can exploit the SSRF by sending a crafted JSON payload to the unprotected healthcheck endpoint, leading to outbound requests to arbitrary URLs when the target system is exposed to the Internet or the network. Even with the low estimated exploitation probability, the potential impact on confidentiality and internal network integrity warrants urgent attention.