CVE-2026-102136: Kiteworks Core Command Execution through Configuration Injection
In multi-node deployments, an attacker who had already obtained code execution on one appliance node could submit a value through an internal cluster interface that was written into monitoring configuration on another node without sufficient validation, potentially allowing OS commands to be executed there. Execution was limited to an unprivileged service account on that node.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
The issue applies to multi-node Kiteworks Core deployments. Exploitation requires an attacker to have already obtained code execution on one appliance node and be able to submit values through the internal cluster interface.
What is the likely impact if exploitation succeeds?
An attacker could cause OS commands to execute on another node by injecting a value that is written into its monitoring configuration. Command execution is limited to the unprivileged service account on the affected node.
Are standalone deployments affected?
The available information identifies the issue specifically in multi-node deployments and describes exploitation through an internal cluster interface. It does not state that standalone deployments are affected.