Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2026-102103

Kiteworks Email Protection Gateway server-side request forgery

Published
Last modified
Status
published
Known exploitation
Not listed in CISA KEV
Fix
Fixed in 9.5.0
Public exploit
None on Exploit-DB
CISA SSVC
  • Exploitation: none
  • Automatable: yes
  • Technical impact: partial
?

Decision points from CISA's Vulnrichment, assessed (SSVC 2.0.3).

SSVC documentation

Summary

Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery (SSRF). A server-side request forgery (SSRF) weakness in Kiteworks Email Protection Gateway could allow a remote, unauthenticated attacker to induce the gateway to issue crafted requests to internal or otherwise unintended network destinations. The requests are triggered while the gateway retrieves a certificate revocation list in an inbound message. Depending on the services reachable from the gateway, this could disclose sensitive internal information or disrupt gateway operation.

Affected versions

  • Kiteworks Email Protection Gateway

    fixed in 9.5.0

References 2

GitHub · kiteworks/security-advisories

raw.githubusercontent.com