CVE-2026-102091: Kiteworks Secure Data Forms server-side request forgery

Q: Which deployments are affected?

Kiteworks Secure Data Forms versions before 9.5.0 are affected. The provided information does not identify any configuration prerequisite or deployment limitation.

Q: Does an attacker need an account or user interaction to exploit this issue?

No. The vulnerability is described as exploitable remotely by an unauthenticated attacker, with no user interaction required.

Q: What could an attacker access through exploitation?

An attacker could cause the server to make arbitrary outbound network requests and read the responses. This could expose internal-only services or other resources protected by network restrictions.

Published Sep 30, 2026

Updated

Kiteworks Secure Data Forms before version 9.5.0 is vulnerable to Server-Side Request Forgery that could allow an unauthenticated, remote attacker to make the server issue arbitrary outbound network requests and read back the responses. This could potentially be used to reach internal-only services or other network-restricted resources.

Affected Software

1 affected component

Kiteworks Secure Data Forms<9.5.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Kiteworks Secure Data Forms to a version that resolves this vulnerability.
Fixed in 9.5.0

Event History

Sep 30, 2026

CVE Published

via MITRE·08:05 PM

Data Sourced

via MITRE·08:05 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·09:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are affected?

Kiteworks Secure Data Forms versions before 9.5.0 are affected. The provided information does not identify any configuration prerequisite or deployment limitation.

Does an attacker need an account or user interaction to exploit this issue?

No. The vulnerability is described as exploitable remotely by an unauthenticated attacker, with no user interaction required.

What could an attacker access through exploitation?

An attacker could cause the server to make arbitrary outbound network requests and read the responses. This could expose internal-only services or other resources protected by network restrictions.

CVE-2026-102091: Kiteworks Secure Data Forms server-side request forgery

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are affected?

Does an attacker need an account or user interaction to exploit this issue?

What could an attacker access through exploitation?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

Does an attacker need an account or user interaction to exploit this issue?

What could an attacker access through exploitation?