CVE-2026-102102

Executive Summary

CVE-2026-102102 is a server-side request forgery (SSRF) vulnerability in Kiteworks Email Protection Gateway affecting versions prior to 9.5.0. A remote, unauthenticated attacker can induce the gateway to issue crafted requests toward internal or otherwise unintended network destinations during the processing of an inbound message, specifically while the gateway retrieves an issuer certificate. Successful exploitation may disclose sensitive internal information or disrupt gateway operation, yielding a CVSS v3.1 base score of 9.1 (Critical).

Technical Analysis

The vulnerability is classified under CWE-918 (Server-Side Request Forgery). The core weakness resides in the Email Protection Gateway's handling of inbound email messages. When the gateway processes an inbound message, it performs a certificate retrieval operation to obtain an issuer certificate. The NVD description states that the SSRF condition is triggered "while the gateway retrieves an issuer certificate in an inbound message."

The mechanism at the vulnerability-class level is as follows: the gateway consumes attacker-influenceable input from an inbound message and uses that input to construct an outbound network request. Because the input is not adequately validated or constrained to an allowlist of trusted destinations, an attacker can steer the resulting request to an internal or otherwise unintended network destination. This is a classic SSRF pattern: the server-side component acts as a proxy for attacker-controlled requests, crossing trust boundaries that external clients cannot normally cross.

Two characteristics elevate severity. First, the attack is unauthenticated (PR:N) and network-reachable (AV:N), meaning no credentials or prior access are required; an attacker only needs the ability to deliver an inbound message that the gateway will process. Second, the request is triggered automatically as part of routine gateway processing, so exploitation does not depend on a victim user interacting with the message (UI:N).

The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H indicates high confidentiality impact (C:H) and high availability impact (A:H). The confidentiality impact reflects the potential to disclose sensitive internal information reachable from the gateway. The availability impact reflects the potential to disrupt gateway operation via the induced requests. Integrity impact is not scored (I:N) in this vector. The scope is unchanged (S:U), meaning the impact is assessed as remaining within the gateway's security authority, though the requests themselves may reach other internal services.

No public proof-of-concept, exploit code, or Nuclei template is known at the time of this report. No CISA KEV listing exists. EPSS has not been scored by FIRST.org, so no exploitation-likelihood probability is available; none should be assumed.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class (CWE-918) and the NVD description. Only the behavior described in NVD is asserted — the issuer-certificate retrieval path in an inbound message — and no specific functions, endpoints, or parameters are named because none are provided.

1. Reconnaissance / target identification: An attacker identifies an internet-facing Kiteworks Email Protection Gateway instance running a version prior to 9.5.0. Identification may be performed via banner/version fingerprinting or by observing gateway behavior in response to test messages. Because exploitation is unauthenticated, the attacker does not need to acquire credentials; they only need the ability to send mail that the gateway will process.

2. Triggering the flaw: The attacker crafts an inbound message such that the gateway, during its certificate processing workflow, performs an issuer-certificate retrieval. This retrieval is the server-side request that the flaw allows the attacker to influence. The attacker supplies input intended to redirect the retrieval target away from a legitimate issuer location toward an internal or otherwise unintended network destination. The precise input field or message construct that carries this influence is not detailed in the NVD description and is therefore not specified here.

3. Payload / execution at the vulnerability-class level: At the SSRF class level, the attacker causes the gateway to issue outbound requests to destinations of the attacker's choosing. This functions as an SSRF proxy: the gateway becomes the source of requests that an external party could not otherwise originate from inside the trusted network boundary. The attacker may direct requests toward internal services, internal-only endpoints, or address ranges that should not be reachable from outside.

4. Post-exploitation impact: Consistent with the NVD description, the attacker may obtain disclosure of sensitive internal information observable via the gateway's requests and responses, or may cause disruption of gateway operation. The NVD text explicitly frames impact as conditional: "Depending on the services reachable from the gateway, this could disclose sensitive internal information or disrupt gateway operation." No lateral movement, code execution, or credential theft is claimed by the source data and none is asserted here.

Because the vulnerability is triggered during processing of an inbound message, exploitation does not require the message be opened or interacted with by a human; the gateway's automated handling is sufficient. This reduces the dependency on social engineering and increases the value of the vector for opportunistic scanning.

Impact Assessment

The CVSS v3.1 base score is 9.1 (Critical). Subscore interpretation based on the provided vector:

• Attack Vector (AV:N — Network): exploitable remotely; no local or adjacent access required.
• Attack Complexity (AC:L — Low): no specialized conditions or race windows are indicated.
• Privileges Required (PR:N — None): unauthenticated; no account needed.
• User Interaction (UI:N — None): no victim action required; triggered by automated gateway processing.
• Scope (S:U — Unchanged): impact assessed as contained within the gateway's security authority.
• Confidentiality (C:H — High): potential disclosure of sensitive internal information.
• Integrity (I:N — None): not scored as an integrity impact in this vector.
• Availability (A:H — High): potential disruption of gateway operation.

Business impact: An Email Protection Gateway sits at a trust boundary, processing inbound mail on behalf of an organization. An SSRF that lets an external party steer the gateway's outbound requests can expose internal network topology and information, and can be used to reach services that assume they are protected by network position. The high availability subscore indicates the induced requests may be leveraged to degrade or disrupt the gateway itself, which can interrupt mail security processing for the organization.

Blast radius: The direct target is the affected Kiteworks Email Protection Gateway deployment. The realized impact depends on what the gateway can reach — the NVD description explicitly conditions impact on "the services reachable from the gateway." In segmented environments where the gateway can reach internal management or metadata services, the confidentiality exposure grows; in tightly segmented environments it is reduced. Because the vulnerability is unauthenticated and remotely triggerable, any internet-reachable pre-9.5.0 deployment is exposed.

Affected systems: Kiteworks Email Protection Gateway prior to 9.5.0. No affected-version package data is available from OSV, and no specific version range list was supplied beyond the "before version 9.5.0" statement in the NVD description.

Exploitation-in-the-wild status: No evidence of active exploitation was provided. Not listed in CISA KEV. No public PoC or exploit code. Not scored by EPSS. Given the unremediated state and unauthenticated vector, treat as a high-priority exposure pending patching.

Detection Guidance

Detection must focus on anomalous outbound requests originating from the Email Protection Gateway during inbound message processing, particularly connections to internal or unintended destinations. Because no PoC specifies exact payloads, detections below are behavioral and target the SSRF pattern and the gateway's certificate-retrieval workflow.

Sigma Rule

title: Kiteworks Email Protection Gateway Potential SSRF via Inbound Message Certificate Retrieval
id: 7b3f9c2a-1e44-4d8a-9c11-2f6a0b5d9e01
status: experimental
description: Detects outbound network connections initiated by the Kiteworks Email Protection Gateway to internal or unintended destinations, consistent with SSRF (CWE-918) triggered while retrieving an issuer certificate from an inbound message. Affects versions prior to 9.5.0.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-102102
author: Threat Intelligence
date: 2026/01/01
tags:
  - attack.t1190
  - cwe.918
logsource:
  category: network_connection
  product: windows
detection:
  selection_process:
    Image|endswith:
      - 'kiteworks-gateway'
      - 'email-protection-gateway'
      - 'kiteworks'
  selection_dest_internal:
    DestinationIp|cidr:
      - '10.0.0.0/8'
      - '172.16.0.0/12'
      - '192.168.0.0/16'
      - '127.0.0.0/8'
      - '169.254.0.0/16'
  selection_dest_port:
    DestinationPort:
      - 80
      - 443
      - 8080
      - 8443
      - 25
      - 389
      - 636
  condition: selection_process and selection_dest_internal and selection_dest_port
falsepositives:
  - Legitimate gateway connections to internal directory or PKI services
  - Internal mail routing and certificate validation against internal CAs
level: high

YARA Rule

rule CVE_2026_102102_Kiteworks_EPG_SSRF_Certificate_Retrieval
{
    meta:
        description = "Detects indicators of SSRF exploitation attempts against Kiteworks Email Protection Gateway (< 9.5.0) during issuer certificate retrieval in inbound messages"
        author = "Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-102102"
        cve = "CVE-2026-102102"
        date = "2026-01-01"
        severity = "critical"

    strings:
        $cert_hdr = "issuer" nocase
        $cert_field1 = "certificate" nocase
        $cert_field2 = "CertIssuer" nocase
        $cert_field3 = "issuerCert" nocase
        $wire1 = "http://127.0.0.1" nocase
        $wire2 = "http://169.254.169.254" nocase
        $wire3 = "http://localhost" nocase
        $gateway = "Kiteworks" nocase

    condition:
        $gateway and (
            ($cert_hdr and 1 of ($cert_field*)) or
            (1 of ($wire*) and 1 of ($cert_field*))
        )
}

Suricata IDS Rule

alert tcp $HOME_NET any -> $HOME_NET [80,443,8080,8443] (msg:"CVE-2026-102102 Kiteworks Email Protection Gateway SSRF Certificate Retrieval Attempt"; flow:to_server,established; content:"issuer"; nocase; content:"certificate"; nocase; distance:0; within:512; reference:cve,2026-102102; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-102102; classtype:attempted-recon; sid:2026102102; rev:1;)

alert tcp $HOME_NET any -> [127.0.0.0/8,169.254.0.0/16,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16] any (msg:"CVE-2026-102102 Kiteworks EPG SSRF Outbound to Internal Destination"; flow:to_server; reference:cve,2026-102102; classtype:attempted-recon; sid:2026102103; rev:1;)

Elastic Detection

sequence by process.entity_id with maxspan=30s
  [ network where process.name : ("kiteworks-gateway", "email-protection-gateway", "kiteworks")
      and destination.ip : ("127.0.0.0/8", "169.254.0.0/16", "10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16") ]
  [ network where process.name : ("kiteworks-gateway", "email-protection-gateway", "kiteworks")
      and destination.port in (80, 443, 8080, 8443) ]

Splunk SPL Query

index=network sourcetype=firewall OR sourcetype=proxy
| search process_name IN ("kiteworks-gateway","email-protection-gateway","kiteworks")
| eval is_internal_dest=if(cidrmatch("10.0.0.0/8",dest_ip) OR cidrmatch("172.16.0.0/12",dest_ip) OR cidrmatch("192.168.0.0/16",dest_ip) OR cidrmatch("127.0.0.0/8",dest_ip) OR cidrmatch("169.254.0.0/16",dest_ip),1,0)
| where is_internal_dest=1 AND dest_port IN (80,443,8080,8443,25,389,636)
| stats count min(_time) as first_seen max(_time) as last_seen values(dest_ip) as destinations values(dest_port) as ports by src_ip, process_name
| where count > 5
| sort - count

Wazuh OSSEC Rule

<group name="kiteworks,ssrf,cve-2026-102102,">
  <rule id="2026102102" level="12">
    <decoded_as>json</decoded_as>
    <field name="process.name">kiteworks-gateway|email-protection-gateway|kiteworks</field>
    <field name="destination.ip">^127\.|^169\.254\.|^10\.|^172\.(1[6-9]|2[0-9]|3[01])\.|^192\.168\.</field>
    <field name="destination.port">^(80|443|8080|8443|25|389|636)$</field>
    <description>CVE-2026-102102: Kiteworks Email Protection Gateway possible SSRF outbound request to internal destination during issuer certificate retrieval</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cwe_918,network_anomaly,</group>
  </rule>

  <rule id="2026102103" level="10">
    <if_sid>2026102102</if_sid>
    <field name="destination.ip">^169\.254\.169\.254$</field>
    <description>CVE-2026-102102: Kiteworks EPG SSRF to cloud metadata endpoint (high confidence)</description>
    <group>cwe_918,cloud_metadata,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations (until a patch is validated and deployed):

• Enforce network egress filtering on the Email Protection Gateway segment so the gateway can reach only the specific internal services it legitimately requires (e.g., approved PKI/issuer certificate sources). Deny access to all other internal ranges, management interfaces, and cloud metadata endpoints (169.254.169.254).
• Place the gateway in a dedicated, tightly segmented network zone with no routing to sensitive internal services.
• Block outbound connections from the gateway to loopback and link-local address ranges.
• Monitor outbound connections from the gateway for anomalies; alert on connections to internal destinations during message processing (see Detection Guidance).
• If the gateway does not require the affected certificate-retrieval path for legitimate operation, consider restricting message types or sources that trigger issuer certificate retrieval, subject to the vendor's guidance and functional requirements.

2. Patch / upgrade steps:

• The NVD description identifies version 9.5.0 as the fixed threshold. Upgrade Kiteworks Email Protection Gateway to 9.5.0 or later.
• Because no patch evidence is available from tracked sources, verify the availability and integrity of the 9.5.0 release directly with Kiteworks before deployment. Confirm the release notes explicitly address the SSRF condition in issuer certificate retrieval described in CVE-2026-102102.
• Test the upgrade in a staging environment that mirrors the gateway's network position and message-processing configuration before production rollout.
• After upgrading, re-verify that egress filtering rules remain in place.

3. Long-term hardening:

• Maintain strict egress allowlisting for any component that processes untrusted, external input, including email gateways.
• Require input validation and destination allowlisting for any server-side request driven by external content, specifically any URL or destination derived from message data such as issuer certificate references.
• Adopt network segmentation such that a compromise or SSRF in an internet-facing gateway cannot reach sensitive internal services or metadata endpoints.
• Continuously monitor vendor advisories for the fixed release and subscribe to Kiteworks security notifications.

References

• NVD — CVE-2026-102102: https://nvd.nist.gov/vuln/detail/CVE-2026-102102
• MITRE CWE-918 — Server-Side Request Forgery (SSRF): https://cwe.mitre.org/data/definitions/918.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• Kiteworks Security Advisories (vendor advisory repository — verify the specific advisory for Email Protection Gateway 9.5.0): https://www.kiteworks.com/security/
• CISA Known Exploited Vulnerabilities Catalog (checked — CVE-2026-102102 is NOT listed at time of writing): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat actor campaigns / exploit-in-the-wild: No evidence of active exploitation, named threat actor activity, public PoC, or exploit code is associated with CVE-2026-102102 in the provided data. EPSS has not been scored by FIRST.org. No CISA KEV entry. Exploitation likelihood cannot be quantified at this time.