CVE-2026-102103

CriticalCVSS 9.1/10Last modified Oct 8, 2026

Description

Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery (SSRF). A server-side request forgery (SSRF) weakness in Kiteworks Email Protection Gateway could allow a remote, unauthenticated attacker to induce the gateway to issue crafted requests to internal or otherwise unintended network destinations. The requests are triggered while the gateway retrieves a certificate revocation list in an inbound message. Depending on the services reachable from the gateway, this could disclose sensitive internal information or disrupt gateway operation.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Weakness enumeration

CWE-918

Affected software

No affected versions have been published.

Timeline

Published
Sep 30, 2026
Last modified
Oct 8, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-1021049.1Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery (SSRF). A server-side request forgery (CVE-2026-1021059.1Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery (SSRF). A server-side request forgery (CVE-2026-1021069.1Improper authentication in a Kiteworks Email Protection Gateway administrative service. An administrative service in Kiteworks Email ProtectCVE-2026-1021074.6Kiteworks Core contains a business logic flaw in a Kiteworks file-request feature allowed an authenticated user to send a request that appeaCVE-2026-1021087.2An authenticated administrator of Kiteworks Email Protection Gateway could submit a crafted serialized object to a cluster management interfCVE-2026-1021097.1A SQL injection vulnerability existed in Kiteworks Secure Data Forms, where a value derived from the authenticated user's stored account datCVE-2026-102116.3A vulnerability was determined in AstrBotDevs AstrBot 4.23.6. Affected by this issue is the function _normalize_rw_path of the file astrbot/CVE-2026-1021105.9An endpoint used during initial appliance setup did not require authentication and did not correctly enforce its intended state preconditionCVE-2026-1021114.9Kiteworks did not enforce the maximum permitted value for a configurable security-policy setting. An authenticated administrator could set tCVE-2026-1021127.8A privilege escalation vulnerability in Kiteworks could allow an attacker who has already obtained code execution as an unprivileged backendCVE-2026-1021137.8A privilege escalation vulnerability in Kiteworks could allow an attacker who has already obtained code execution as an unprivileged backendCVE-2026-1021147.2A command injection vulnerability in Kiteworks could allow a high-privileged authenticated administrator to execute arbitrary operating-syst