CVE-2026-102095: Kiteworks Email Protection Gateway server-side request forgery
Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery. Kiteworks Email Protection Gateway performed server-side fetches of URLs contained in the message content it processed, without adequately restricting the fetch destination. A remote, unauthenticated sender could craft a message that caused the gateway to issue requests to internal services and cloud instance metadata endpoints and return the responses, potentially disclosing sensitive internal data and, depending on the internal service reached, affecting its state.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Kiteworks Email Protection Gatewayto a version that resolves this vulnerability.Fixed in 9.5.0
Event History
Frequently Asked Questions
Which deployments are affected?
Kiteworks Email Protection Gateway versions before 9.5.0 are affected. The issue is reachable through message content processed by the gateway.
What does an attacker need to exploit this issue?
An attacker needs only to send a crafted message containing URLs. No authentication or user interaction is required.
What could an attacker access or do?
The gateway can be induced to request internal services or cloud instance metadata endpoints and return their responses, which may disclose sensitive internal data. Depending on the internal service reached, the attacker may also affect that service's state.
What is the available remediation?
Upgrade Kiteworks Email Protection Gateway to version 9.5.0 or later.