CVE-2026-102103

Executive Summary

CVE-2026-102103 is a Server-Side Request Forgery (SSRF) vulnerability in the Kiteworks Email Protection Gateway affecting versions before 9.5.0. A remote, unauthenticated attacker can induce the gateway to issue crafted requests to internal or otherwise unintended network destinations while it retrieves a certificate revocation list (CRL) from an inbound message. Successful exploitation can disclose sensitive internal information reachable from the gateway or disrupt gateway operation, reflected in a CVSS 3.1 base score of 9.1 (High confidentiality and availability impact).

Technical Analysis

The vulnerability resides in the certificate revocation list (CRL) retrieval workflow of Kiteworks Email Protection Gateway. Per the NVD description, the gateway "retrieves a certificate revocation list in an inbound message" — meaning the CRL location is derived from, or influenced by, message content processed by the gateway. The server-side component then performs an outbound network fetch to that location without adequately validating or restricting the destination.

Because the request target is attacker-influenceable and the request is issued by the gateway itself, the traffic originates from a trusted internal position. This is the classic SSRF pattern (CWE-918): the gateway becomes a request proxy into network segments ordinarily unreachable from the external attacker. The description explicitly states the weakness "could allow a remote, unauthenticated attacker to induce the gateway to issue crafted requests to internal or otherwise unintended network destinations," confirming both the unauthenticated remote vector (PR:N, AV:N) and the internal-routing consequence.

The attack surface is the inbound email/message ingestion path of the Email Protection Gateway. No authentication is required (PR:N), no user interaction is required (UI:N), and the attack complexity is low (AC:L). The CVSS impact vector (C:H/I:N/A:H) indicates the primary consequences are information disclosure and availability disruption, not integrity tampering.

Important accuracy note: the NVD description does not disclose specific function names, class names, parameters, or API endpoints involved in the CRL fetch. No such implementation detail is available and none should be assumed. The relevant behavior is limited to what is stated: the gateway fetches a CRL referenced in an inbound message, and the destination of that fetch can be influenced by the attacker.

Exploitation Scenarios

No public PoC, exploit code, or Nuclei template is available as of this report. The following chain is inferred from the vulnerability class (SSRF via server-side CRL retrieval) and the NVD description, and uses only details explicitly stated in that description.

1. Reconnaissance / target identification: The attacker identifies an internet-facing Kiteworks Email Protection Gateway running a version prior to 9.5.0. Since the vector is unauthenticated (PR:N), no credentials are required — the attacker only needs the ability to deliver a message that reaches the gateway's email protection processing path.

2. Trigger of the flaw class: The attacker crafts an inbound message that references a certificate revocation list location they control or specify. Because the gateway retrieves the CRL referenced in the inbound message, the attacker can cause the gateway to perform an outbound request to a destination of their choosing. The exact message field and CRL reference mechanism are not disclosed in the NVD description and are therefore not asserted here.

3. Request issuance (vulnerability-class level): The gateway, acting as the requesting party, issues a server-side fetch to the attacker-specified destination. This is the SSRF condition: a server-initiated request to an unintended network location, including internal/private network addresses and services reachable from the gateway host.

4. Post-exploitation impact: Per the description, depending on the services reachable from the gateway, the attacker may (a) disclose sensitive internal information — for example, content returned from internal services the gateway can reach, or metadata about internal endpoints — and/or (b) disrupt gateway operation, consistent with the C:H/I:N/A:H vector. Because the request originates from the trusted gateway, network controls that only inspect external ingress may not flag the outbound request.

Impact Assessment

• CVSS 3.1 base score: 9.1 (Critical) — AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H.
• Confidentiality: High — SSRF can expose sensitive internal information from services reachable by the gateway.
• Integrity: None — the vector reports no integrity impact; the described mechanism is request issuance and information retrieval/disruption, not data modification at the vulnerable component.
• Availability: High — the description states exploitation "could ... disrupt gateway operation," supporting the A:H rating.
• Scope: Unchanged (S:U) — impact is assessed within the security authority of the vulnerable gateway.
• Blast radius: Limited to systems and services reachable from the gateway host on internal or otherwise unintended networks. The gateway's position within the mail-flow path makes it a high-value pivot point because outbound requests appear to originate from a trusted internal component.
• Who is affected: Organizations operating Kiteworks Email Protection Gateway in versions before 9.5.0 that process inbound messages from untrusted senders.
• Exploitability context: Unauthenticated, low complexity, no user interaction required. No public exploit, no Nuclei template, no CISA KEV listing, and no EPSS score are currently recorded. Exploitation is nonetheless plausible given the low bar to trigger and the critical severity.

Detection Guidance

Detection here is challenging because the malicious request is generated by the gateway itself and travels outbound to an attacker-influenced destination. The most reliable signals are anomalous outbound connections from the gateway process/host and the preceding inbound message that supplied the CRL reference. The following rules are generalized to the SSRF-via-CRL-retrieval behavior described in the NVD data and are intended as detection starting points requiring environment-specific tuning.

Sigma Rule

title: Potential SSRF via Kiteworks Email Protection Gateway CRL Retrieval
id: 7d2f9a10-3c4b-4e8a-9f21-cve2026102103
status: experimental
description: Detects outbound network connections from the Kiteworks Email Protection Gateway process to internal/private or unexpected destinations, consistent with SSRF triggered during certificate revocation list (CRL) retrieval referenced in an inbound message.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-102103
author: valtersit.com
date: 2026/01/01
logsource:
  category: network_connection
  product: windows
detection:
  selection_priv:
    Image|endswith: '\kiteworks\gateway.exe'
    DestinationIp|cidr:
      - '10.0.0.0/8'
      - '172.16.0.0/12'
      - '192.168.0.0/16'
      - '127.0.0.0/8'
      - '169.254.0.0/16'
  selection_port:
    DestinationPort:
      - 22
      - 23
      - 25
      - 445
      - 1433
      - 3306
      - 5432
      - 6379
      - 9200
  condition: selection_priv and selection_port
falsepositives:
  - Legitimate gateway connectivity to internal mail/CRL or directory infrastructure
  - Localhost health checks
level: high
tags:
  - attack.t1190
  - cve.2026.102103

YARA Rule

rule CVE_2026_102103_Kiteworks_SSRF_CRL_Reference
{
    meta:
        description = "Detects email message content referencing a CRL/OCSP URL pointing to an internal or otherwise unintended network destination, consistent with SSRF against Kiteworks Email Protection Gateway (CVE-2026-102103)."
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-102103"
        date = "2026-01-01"
        severity = "critical"

    strings:
        $crl  = "CRL" nocase
        $crl2 = "certificate revocation list" nocase
        $http = "http://" nocase
        $https = "https://" nocase
        $priv1 = "127.0.0.1"
        $priv2 = "169.254."
        $priv3 = "10."
        $priv4 = "192.168."
        $priv5 = "172.16."

    condition:
        ($crl or $crl2) and ($http or $https) and any of ($priv*)
}

Suricata IDS Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-102103 Kiteworks Email Protection Gateway SSRF via CRL Retrieval - outbound to internal-range host"; flow:established,to_server; content:"GET"; http_method; content:"Host|3a|"; http_header; pcre:"/Host\x3a\s*(?:127\.0\.0\.1|10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[01])\.|169\.254\.)/Hi"; classtype:attempted-recon; reference:cve,2026-102103; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-102103; sid:2026102103; rev:1;)

Elastic Detection

sequence by host.name with maxspan=5m
  [ network where process.name : ("kiteworks" or "gateway") and
      destination.ip : ("10.0.0.0/8","172.16.0.0/12","192.168.0.0/16","127.0.0.0/8","169.254.0.0/16") ]
  [ network where process.name : ("kiteworks" or "gateway") and
      destination.port : (22,23,25,445,1433,3306,5432,6379,9200) ]

Splunk SPL Query

index=network sourcetype=pan:traffic OR sourcetype=zeek:conn OR sourcetype=firewall
| eval dest_internal=if(match(dest_ip, "^(10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[01])\.|127\.|169\.254\.)"), 1, 0)
| where dest_internal=1 AND (src_process="kiteworks" OR src_process="gateway" OR src_user="gateway")
| where dest_port IN (22,23,25,445,1433,3306,5432,6379,9200)
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip dest_ip dest_port
| sort - count

Wazuh OSSEC Rule

<group name="kiteworks,ssrf,">
  <rule id="2026103" level="12">
    <decoded_as>json</decoded_as>
    <field name="process.name">kiteworks|gateway</field>
    <field name="destination.ip">10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[01])\.|127\.|169\.254\.</field>
    <description>CVE-2026-102103 - Kiteworks Email Protection Gateway issued outbound connection to internal/unintended destination, possible SSRF via CRL retrieval.</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_102103,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations:

• Upgrade Kiteworks Email Protection Gateway to version 9.5.0 or later. This is the only version boundary the NVD description provides ("before version 9.5.0"); no vendor patch artifact or advisory is currently tracked.
• Until upgrade, restrict outbound network egress from the gateway host to only the specific destinations required for legitimate operation (e.g., approved CRL/OCSP responders and mail-flow dependencies). Deny egress to internal RFC1918 ranges, loopback, and link-local addresses unless explicitly required.
• Apply egress filtering at the network boundary so that server-initiated requests from the gateway cannot reach internal management interfaces, metadata endpoints, or unexpected internal service ports.
• Monitor for and, where feasible, block outbound connections from the gateway to non-standard destinations while the SSRF path remains unaddressed.

2. Patch/upgrade steps:

• Confirm the deployed gateway version and determine whether it is below 9.5.0.
• Plan an upgrade to 9.5.0 or later per vendor release guidance. Because patch confidence is 0/4 and no vendor fix reference is tracked, verify the fix directly against Kiteworks' official advisory/release notes before relying on the version boundary.
• Validate post-upgrade that CRL retrieval behavior is constrained and that the SSRF path is no longer reachable.

3. Long-term hardening:

• Treat all attacker-influenceable references (such as a CRL location in an inbound message) as untrusted input and enforce destination allow-listing and address validation on all server-initiated fetches.
• Implement SSRF-resistant architecture: resolve and validate target addresses against an allow-list, block private/loopback/link-local ranges, and avoid following redirects to unintended destinations.
• Segment the Email Protection Gateway into a network zone with minimal reachable internal services to reduce SSRF blast radius.
• Add continuous monitoring and alerting for outbound connections from mail-gateway components to internal or unusual destinations.

References

• NVD — CVE-2026-102103: https://nvd.nist.gov/vuln/detail/CVE-2026-102103
• MITRE CWE-918 (Server-Side Request Forgery): https://cwe.mitre.org/data/definitions/918.html
• MITRE ATT&CK T1190 (Exploit Public-Facing Application): https://attack.mitre.org/techniques/T1190/
• Kiteworks — vendor product/security advisories (verify the 9.5.0 fix against the official Kiteworks advisory; not tracked in this dataset)
• CISA Known Exploited Vulnerabilities catalog: Not listed (no KEV entry as of this report).

Threat actor and exploit-in-the-wild evidence: None identified. No public PoC, no Nuclei template, no exploit code, no EPSS score, and no CISA KEV listing are associated with CVE-2026-102103 at the time of writing.