CVE-2026-102145

Kiteworks Core Server-Side Request Forgery through CRLF Injection

Published Sep 30, 2026 CVSS 3.1 · 6.6 Medium EPSS < 1% KEV · Not listed

Description

An authenticated administrator could cause the server to issue requests to, and interact with, internal network services that are not meant to be reachable through this interface. On its own this did not result in code execution.

Analysis

Technical impact

An authenticated administrator can manipulate the server to issue requests to internal network services that are not exposed through the normal interface, enabling the discovery or interaction with resources that should remain unreachable. This vulnerability is a server‑side request forgery (SSRF) caused by CRLF injection (CWE‑93) and does not, on its own, execute code on the Kiteworks Core server, but it does expose internal services and creates a potential foothold for further attacks.

Affected Systems

Kiteworks Core is the only affected product; version information is not provided in the advisory. Review the vendor’s security notice for details on which releases require the patch.

Risk and Exploitability

The CVSS score of 6.6 indicates moderate severity. Because the attack requires authenticated administrator privileges, the exploitability is limited to accounts with such rights, but the lack of code execution does not eliminate the risk of data exposure or lateral movement. The EPSS score is not available, and the issue is not listed in any KEV catalog.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Kiteworks

Core

unknown

Version	Status	Constraints
`0`	affected	< 9.5.1
`9.5.1`	unaffected	—

Configuration 1 [-]

cpe:2.3:a:accellion:kiteworks:*:*:*:*:*:*:*:*

No data.

Vendor Product Versions

Kiteworks

Core

Version	Status	Scheme	Platform
`[0,9.5.1)`	affected	generic	—
`9.5.1`	unaffected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the Kiteworks Core patch that resolves the CRLF injection SSRF vulnerability.
Restrict administrator access and enforce strong authentication to limit the attacker’s ability to trigger the vulnerability.
Implement network segmentation or firewall rules to block unintended internal service requests originating from the Kiteworks server.

Generated by OpenCVE AI on September 30, 2026 at 22:32 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.282% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/kiteworks/security-advisories/security/advisories/GHSA-h97r-j99c-q8xc
https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json

History

Oct 13, 2026 12:15 PM First appearance in the feed. Affected versions updated. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Accellion Accellion kiteworks
CPEs		cpe:2.3:a:accellion:kiteworks::::::::
Vendors & Products		Accellion Accellion kiteworks

Oct 1, 2026 2:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Oct 1, 2026 6:30 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Kiteworks Kiteworks core
Vendors & Products		Kiteworks Kiteworks core

Sep 30, 2026 8:30 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		An authenticated administrator could cause the server to issue requests to, and interact with, internal network services that are not meant to be reachable through this interface. On its own this did not result in code execution.
Title		Kiteworks Core Server-Side Request Forgery through CRLF Injection
Weaknesses		CWE-93
References		https://github.com/kiteworks/security-advisories/security/advisories/GHSA-h97r-j99c-q8xc https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json
Metrics		cvssV3_1 `{'score': 6.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L'}`