Kiteworks Email Protection Gateway: Server-side request forgery
Summary
Kiteworks Email Protection Gateway versions before 9.5.0 fetch URLs contained in processed message content without adequately restricting the destination. A remote, unauthenticated sender can craft a message that makes the gateway request internal services and cloud instance metadata endpoints and return the responses. This can disclose sensitive internal data and, depending on the service reached, affect its state.
Affected
- Kiteworks Email Protection Gateway versions before 9.5.0 (affected range 0 to < 9.5.0)
Fixed in
- Upgrade to Kiteworks Email Protection Gateway 9.5.0 or later
Workaround
Unknown. No vendor-documented workaround was found. The vendor advisory recommends the upgrade.
Exploitation
- CISA SSVC: Exploitation none, automatable yes, technical impact total.
- No in-the-wild exploitation or public proof of concept was found in the sources reviewed.
Our recommendation
- Inventory all Email Protection Gateway instances and their versions.
- Upgrade every instance below 9.5.0 to 9.5.0 or later, and check the vendor advisory first.
- If patching is delayed, review gateway outbound-request logs for requests to internal addresses and metadata endpoints.
- Check whether any gateway runs in a cloud account with instance metadata access and restrict that access.
- Treat internet-facing deployments as high priority, because any unauthenticated sender can trigger the flaw.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Kiteworks security advisory GHSA-f252-4w8q-g74g github.com
- CISA CSAF advisory VA-26-274-01 raw.githubusercontent.com
- VulDB CVE-2026-102095 vuldb.com
- Strix CVE-2026-102095 www.strix.ai
- OpenCVE CVE-2026-102095 app.opencve.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 07:53.
Original description (NVD)
Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery. Kiteworks Email Protection Gateway performed server-side fetches of URLs contained in the message content it processed, without adequately restricting the fetch destination. A remote, unauthenticated sender could craft a message that caused the gateway to issue requests to internal services and cloud instance metadata endpoints and return the responses, potentially disclosing sensitive internal data and, depending on the internal service reached, affecting its state.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.