CVE-2026-102095— Kiteworks Email Protection Gateway server-side request forgery
Quick assessment
Affected
Kiteworks Email Protection Gateway
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Kiteworks 邮件防护网关（Email Protection Gateway）在 9.5.0 版本之前存在服务器端请求伪造（SSRF，Server-Side Request Forgery）漏洞。该网关在处理邮件内容时，会对其中包含的 URL 执行服务器端抓取操作，但未对抓取目标进行充分限制。远程未认证的攻击者可以构造特定邮件，诱使网关向内部服务或云实例元数据端点发起请求并返回响应，从而可能泄露敏感的内部数据；此外，根据所访问的内部服务不同，还可能影响其状态。
Possible ATT&CK Techniques 1 AI
T1090 · Proxy
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-102095
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Kiteworks Email Protection Gateway server-side request forgery
Source: CVE Program / CVE List V5
Vulnerability Description
Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery. Kiteworks Email Protection Gateway performed server-side fetches of URLs contained in the message content it processed, without adequately restricting the fetch destination. A remote, unauthenticated sender could craft a message that caused the gateway to issue requests to internal services and cloud instance metadata endpoints and return the responses, potentially disclosing sensitive internal data and, depending on the internal service reached, affecting its state.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
服务端请求伪造(SSRF)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Kiteworks | Email Protection Gateway | 0 ~ 9.5.0 | - |
|
II. Public POCs for CVE-2026-102095
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-102095
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-102095 (1)
Other References for CVE-2026-102095 (1)
Same Patch Batch · Kiteworks · 2026-09-30 · 61 CVEs total
| CVE-2026-102115 | 9.8 CRITICAL | Kiteworks Core Authentication Bypass in the Password Reset Workflow |
| CVE-2026-102149 | 9.4 CRITICAL | Kiteworks Email Protection Gateway Improper Access Control |
| CVE-2026-102147 | 9.3 CRITICAL | Kiteworks Core Administrative Account Takeover through Stored Cross-site Scripting (XSS) |
| CVE-2026-102104 | 9.1 CRITICAL | Kiteworks Email Protection Gateway server-side request forgery |
| CVE-2026-102102 | 9.1 CRITICAL | Kiteworks Email Protection Gateway server-side request forgery |
| CVE-2026-102105 | 9.1 CRITICAL | Kiteworks Email Protection Gateway server-side request forgery |
| CVE-2026-102103 | 9.1 CRITICAL | Kiteworks Email Protection Gateway server-side request forgery |
| CVE-2026-102106 | 9.1 CRITICAL | Kiteworks Email Protection Gateway improper authentication |
| CVE-2026-102120 | 8.8 HIGH | Kiteworks Core OS Command Injection |
| CVE-2026-102125 | 8.8 HIGH | Kiteworks Core Sandbox Escape |
| CVE-2026-102092 | 8.7 HIGH | Kiteworks Core stored XSS |
| CVE-2026-102100 | 8.7 HIGH | Kiteworks Core stored XSS |
| CVE-2026-102121 | 8.6 HIGH | Kiteworks Secure Data Forms Exposure of Sensitive Information to an Unauthorized Actor |
| CVE-2026-102126 | 8.1 HIGH | Kiteworks Core Stored Cross-site Scripting (XSS) |
| CVE-2026-102101 | 8.1 HIGH | Kiteworks Core deserialization of untrusted data |
| CVE-2026-102112 | 7.8 HIGH | Kiteworks Core Local Privilege Escalation |
| CVE-2026-102118 | 7.8 HIGH | Kiteworks Core before version 9.5.0 is vulnerable to Local Privilege Escalation |
| CVE-2026-102113 | 7.8 HIGH | Kiteworks Core Local Privilege Escalation |
| CVE-2026-102143 | 7.5 HIGH | Kiteworks Email Protection Gateway Unrestricted Upload of File with Dangerous Type |
| CVE-2026-102128 | 7.5 HIGH | Kiteworks Email Protection Gateway Improper Authentication |
Showing top 20 of 61 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Email Protection Gateway
-
CVE-2026-102105
Kiteworks Email Protection Gateway server-side request forge -
CVE-2026-102106
Kiteworks Email Protection Gateway improper authentication -
CVE-2026-102108
Kiteworks Email Protection Gateway deserialization of untrus -
CVE-2026-102116
Kiteworks Email Protection Gateway Path Traversal -
CVE-2026-102119
Kiteworks Email Protection Gateway Path Traversal
Same vendor: Kiteworks
-
CVE-2026-102105
Kiteworks Email Protection Gateway server-side request forge -
CVE-2026-102106
Kiteworks Email Protection Gateway improper authentication -
CVE-2026-102107
Kiteworks Core user impersonation in a file-request feature -
CVE-2026-102108
Kiteworks Email Protection Gateway deserialization of untrus -
CVE-2026-102109
Kiteworks Secure Data Forms SQL injection
Same weakness: CWE-918
-
CVE-2026-103757
Budibase before 3.41.0 SSRF via uploadUrl in AI Table Genera -
CVE-2026-103291
Ghost 3.20.2 before 6.51.0 SSRF via image-size fetch -
CVE-2026-103287
Ghost 1.18.0 before 6.27.0 Server-Side Request Forgery via W -
CVE-2026-103082
WordPress LA-Studio Element Kit for Elementor plugin <= 1.6. -
CVE-2026-103497
JetBrains YouTrack 2026.2前GitHub集成SSRF漏洞
V. Comments for CVE-2026-102095
No comments yet