Keeper.sh’s calendar module before version 2.18.14 contains a server‑side request forgery guard that validates a hostname’s resolved IP addresses but discards the results before the HTTP connection is established. An attacker who controls authoritative DNS can craft a response that returns a public IP during the validation phase and a private IP when the application performs its own socket‑level DNS resolution. The guard never checks the final resolved address, so the request is allowed to reach internal resources such as metadata services or other private hosts. The flaw requires the attacker to have valid credentials to the service, but once authenticated it can be used to contact any private endpoint reachable from the application.

Users running Keeper.sh calendar modules older than 2.18.14 are vulnerable. Deploying 2.18.14 or later eliminates the SSRF guard bypass.

The CVSS score of 2.3 indicates low generic severity, and the vulnerability is not listed in CISA’s KEV catalog, with no EPSS data available. Despite this, the requirement for authenticated access combined with the ability to reach internal infrastructure constitutes a significant security risk, particularly for environments exposing internal services or cloud metadata endpoints. Attackers with legitimate credentials or those who gain access through phishing or insider compromise can exploit the flaw to obtain sensitive internal information or further pivot within the network. The lack of exploitation data does not diminish the potential impact, and should be prioritized.