CVE-2026-102138: Kiteworks Core Server-Side Request Forgery (SSRF)
An authenticated administrator on a node with an optional, separately licensed gateway role enabled could supply a connector URL that the server retrieved without sufficient validation of its scheme or destination, causing the server to issue requests to internal network services. Exploitation requires the licensed gateway role to be active.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
Only nodes with the optional, separately licensed gateway role enabled are exposed. Exploitation also requires an authenticated administrator account.
What access does an attacker need?
An attacker must have administrator privileges on an affected node and be able to provide a connector URL. They can then cause the server to request internal network services through insufficient validation of the URL scheme or destination.
Is a default installation affected?
The issue requires the optional gateway role to be active, so installations without that separately licensed role enabled are not affected by the described attack path.