Kiteworks Email Protection Gateway: Server-Side Request Forgery (SSRF)
Summary
Kiteworks Email Protection Gateway versions before 9.5.0 contain a Server-Side Request Forgery (SSRF) flaw (CVE-2026-102102, CVSS 9.1). A remote, unauthenticated attacker can make the gateway send crafted requests to internal or unintended network destinations, for example while it retrieves an issuer certificate from an inbound message. Depending on which services are reachable from the gateway, this can disclose internal information or disrupt gateway operation.
Affected
- Kiteworks Email Protection Gateway versions before 9.5.0 (vendor advisory GHSA-jxv9-v53f-c79m)
Fixed in
- Upgrade to Kiteworks Email Protection Gateway 9.5.0 or later (vendor advisory).
- Security update 9.5.1 is reported as the current release; this has not been verified against the primary advisory.
Workaround
- No vendor workaround known. The vendor fix is the upgrade.
- If patching is not immediately possible, restrict outbound traffic from the gateway, especially to internal networks and cloud metadata addresses. This is a general hardening measure and is not confirmed as an official Kiteworks mitigation for this CVE.
Exploitation
- CISA SSVC: exploitation none, automatable yes, technical impact partial.
- No confirmed exploitation in the wild known.
- No public proof of concept found.
Our recommendation
- Identify all Email Protection Gateway instances and their versions, and prioritise internet-facing ones.
- Upgrade to 9.5.0 at minimum; preferably 9.5.1 or later, after checking the vendor advisory.
- Until patched, restrict outbound connections from the gateway to internal networks and cloud metadata endpoints.
- Monitor gateway logs for unusual outbound requests.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Kiteworks GitHub Security Advisory GHSA-jxv9-v53f-c79m github.com
- CISA CSAF advisory va-26-274-01 raw.githubusercontent.com
- VulDB CVE-2026-102102 vuldb.com
- OpenCVE CVE-2026-102102 app.opencve.io
- ThreatInt CVE-2026-102102 cve.threatint.com
- SecurityOnline Kiteworks vulnerabilities securityonline.info
- Cybersecurity Dive: Kiteworks lifts advisory on shutdown www.cybersecuritydive.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 07:51.
Original description (NVD)
Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery (SSRF). A server-side request forgery (SSRF) weakness in Kiteworks Email Protection Gateway could allow a remote, unauthenticated attacker to induce the gateway to issue crafted requests to internal or otherwise unintended network destinations. The requests are triggered while the gateway retrieves an issuer certificate in an inbound message. Depending on the services reachable from the gateway, this could disclose sensitive internal information or disrupt gateway operation.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.