CVE-2026-102095: Kiteworks Email Protection Gateway server-side request forgery

Q: Which deployments are affected?

Kiteworks Email Protection Gateway versions before 9.5.0 are affected. The issue is reachable through message content processed by the gateway.

Q: What does an attacker need to exploit this issue?

An attacker needs only to send a crafted message containing URLs. No authentication or user interaction is required.

Q: What could an attacker access or do?

The gateway can be induced to request internal services or cloud instance metadata endpoints and return their responses, which may disclose sensitive internal data. Depending on the internal service reached, the attacker may also affect that service's state.

Q: What is the available remediation?

Upgrade Kiteworks Email Protection Gateway to version 9.5.0 or later.

Published Sep 30, 2026

Updated

Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery. Kiteworks Email Protection Gateway performed server-side fetches of URLs contained in the message content it processed, without adequately restricting the fetch destination. A remote, unauthenticated sender could craft a message that caused the gateway to issue requests to internal services and cloud instance metadata endpoints and return the responses, potentially disclosing sensitive internal data and, depending on the internal service reached, affecting its state.

Affected Software

1 affected component

Kiteworks Email Protection Gateway<9.5.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Kiteworks Email Protection Gateway to a version that resolves this vulnerability.
Fixed in 9.5.0

Event History

Sep 30, 2026

CVE Published

via MITRE·08:07 PM

Data Sourced

via MITRE·08:07 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·09:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are affected?

Kiteworks Email Protection Gateway versions before 9.5.0 are affected. The issue is reachable through message content processed by the gateway.

What does an attacker need to exploit this issue?

An attacker needs only to send a crafted message containing URLs. No authentication or user interaction is required.

What could an attacker access or do?

The gateway can be induced to request internal services or cloud instance metadata endpoints and return their responses, which may disclose sensitive internal data. Depending on the internal service reached, the attacker may also affect that service's state.

What is the available remediation?

Upgrade Kiteworks Email Protection Gateway to version 9.5.0 or later.

CVE-2026-102095: Kiteworks Email Protection Gateway server-side request forgery

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are affected?

What does an attacker need to exploit this issue?

What could an attacker access or do?

What is the available remediation?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

What does an attacker need to exploit this issue?

What could an attacker access or do?

What is the available remediation?