Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2026-102104

Kiteworks Email Protection Gateway server-side request forgery

Published
Last modified
Status
published
Known exploitation
Not listed in CISA KEV
Fix
Fixed in 9.5.0
Public exploit
None on Exploit-DB
CISA SSVC
  • Exploitation: none
  • Automatable: yes
  • Technical impact: partial
?

Decision points from CISA's Vulnrichment, assessed (SSVC 2.0.3).

SSVC documentation

Summary

Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery (SSRF). A server-side request forgery (SSRF) weakness in Kiteworks Email Protection Gateway could allow a remote, unauthenticated attacker to induce the gateway to issue crafted requests to internal or otherwise unintended network destinations. The requests are triggered while the gateway performs an online certificate status check for an inbound message. Depending on the services reachable from the gateway, this could disclose sensitive internal information or disrupt gateway operation.

Affected versions

  • Kiteworks Email Protection Gateway

    fixed in 9.5.0

References 2

GitHub · kiteworks/security-advisories

raw.githubusercontent.com