Kiteworks Core Server-Side Request Forgery (SSRF)
An authenticated administrator on a node with an optional, separately licensed gateway role enabled could supply a connector URL that the server retrieved without sufficient validation of its scheme or destination, causing the server to issue requests to internal network services. Exploitation requires the licensed gateway role to be active.
CVE-2026-102138
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-102138
Core
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"vendor": "Kiteworks",
"product": "Core",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "9.5.1",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "9.5.1"
}
],
"defaultStatus": "unknown"
}
]- Related CVEs
- CVE-2026-102138
Source reference:
/cveMetadata/cveId
Publisher severity
low
Source reference: /containers/cna/metrics
- Event
- #5172 · Revision 1
- Added to Heist Feed
- Publisher date