CVE-2026-102120: Kiteworks Core OS Command Injection
A privilege escalation vulnerability in Kiteworks could have allowed an attacker who had already obtained code execution on one node of a clustered Kiteworks deployment to run operating system commands with elevated privileges on another node of the same cluster. Insufficient input validation in an internal cluster management function let attacker-supplied values reach a privileged execution context; exploitation requires existing access to a node in the cluster, and the affected function is not reachable from outside the cluster.
Affected Software
Event History
Frequently Asked Questions
Can this be exploited directly from outside the deployment?
No. The affected cluster-management function is not reachable from outside the cluster.
What does an attacker need before they can exploit this?
They must already have obtained code execution on a node in a clustered deployment. The issue can then be used to execute operating-system commands with elevated privileges on another node in the same cluster.
Which environments are exposed to the cross-node impact?
The described impact applies to clustered deployments, where an attacker with code execution on one cluster node can target another node in that cluster.