CVE-2026-102134: Kiteworks Core Unprotected Alternate Channel

Published Sep 30, 2026

Updated

Kiteworks Core did not apply its gateway-level API security controls to every request authenticated through the platform's central authentication service. An authenticated user could reach REST API functionality over a request path on which those controls, including enforcement of signed-out and revoked sessions, were not applied.

Affected Software

1 affected component

Kiteworks Kiteworks Core

Event History

Sep 30, 2026

CVE Published

via MITRE·08:12 PM

Data Sourced

via MITRE·08:12 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·09:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An attacker needs to be authenticated through Kiteworks Core's central authentication service. The CVSS vector indicates the issue can be exploited over the network with low attack complexity and does not require user interaction.

What security controls may be bypassed through the affected request path?

Gateway-level API security controls were not applied on every centrally authenticated request path. This specifically includes enforcement intended to prevent use of signed-out or revoked sessions.

CVE-2026-102134: Kiteworks Core Unprotected Alternate Channel

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

What security controls may be bypassed through the affected request path?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What security controls may be bypassed through the affected request path?