Kiteworks Email Protection Gateway: Server-Side Request Forgery (SSRF)
Summary
The Kiteworks Email Protection Gateway before version 9.5.0 contains a Server-Side Request Forgery (SSRF) weakness. While retrieving a Certificate Revocation List (CRL) for an inbound message, the gateway can be induced to send crafted requests to internal or otherwise unintended network destinations. A remote, unauthenticated attacker can trigger this by sending mail, which could disclose sensitive internal information or disrupt gateway operation, depending on which services the gateway can reach.
Affected
- Kiteworks Email Protection Gateway versions before 9.5.0
Fixed in
- Upgrade to Kiteworks Email Protection Gateway 9.5.0 or later (vendor advisory GHSA-p435-6c3j-4gh5).
- A press report quotes Kiteworks stating that the current release 9.5.1 addresses all known vulnerabilities. This has not been confirmed in the vendor advisory.
Workaround
- No vendor workaround known. Patching is the documented remedy.
- Interim measure (not vendor-documented): restrict outbound connections from the gateway to internal networks and cloud metadata addresses.
Exploitation
- No known exploitation as of the sources checked.
- Not listed in CISA KEV as of the sources checked.
- CISA SSVC assessment: Exploitation none, Automatable yes, Technical Impact partial.
- No public proof-of-concept found.
Our recommendation
- Check the installed Email Protection Gateway version now. Priority is high if it is below 9.5.0.
- Update to 9.5.0 or later, preferably the current release, and confirm the fix against the vendor advisory.
- Until patched, restrict outbound connections from the gateway to internal networks and metadata services, and review gateway logs for unusual outbound requests.
- Verify the gateway is not exposed beyond what is needed for mail flow.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-p435-6c3j-4gh5 (Kiteworks) github.com
- CISA CSAF VA-26-274-01 raw.githubusercontent.com
- Miggo vulnerability database: CVE-2026-102103 www.miggo.io
- OpenCVE: CVE-2026-102103 app.opencve.io
- VulDB: CVE-2026-102103 vuldb.com
- Strix AI: CVE-2026-102103 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 07:51.
Original description (NVD)
Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery (SSRF). A server-side request forgery (SSRF) weakness in Kiteworks Email Protection Gateway could allow a remote, unauthenticated attacker to induce the gateway to issue crafted requests to internal or otherwise unintended network destinations. The requests are triggered while the gateway retrieves a certificate revocation list in an inbound message. Depending on the services reachable from the gateway, this could disclose sensitive internal information or disrupt gateway operation.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.