CVE-2026-102104

Executive Summary

CVE-2026-102104 is a Server-Side Request Forgery (SSRF) vulnerability (CWE-918) in the Kiteworks Email Protection Gateway affecting all versions before 9.5.0. A remote, unauthenticated attacker can cause the gateway to issue crafted requests to internal or otherwise unintended network destinations by abusing the online certificate status check performed on inbound messages. With a CVSS v3.1 base score of 9.1 (AV:N/AC:L/PR:N/UI:N), the flaw enables high-impact confidentiality disclosure and availability disruption of the gateway depending on the reachable internal services.

Technical Analysis

The vulnerability resides in the Email Protection Gateway component of Kiteworks. According to the NVD description, the gateway performs an "online certificate status check for an inbound message." This is a certificate revocation/validity verification step that, by design, requires the gateway to make an outbound network request (typically to an OCSP responder or certificate status endpoint) that is derived from data associated with the inbound message.

This is a classic SSRF pattern (CWE-918) with a specific and important characteristic: the request trigger is automatic and tied to inbound email processing rather than a direct user-supplied URL parameter. Because the certificate status check is performed server-side during the handling of an inbound message, an attacker does not need to authenticate or interact with a UI. They only need the ability to deliver a message that causes the gateway to initiate a certificate status lookup.

The core defect is insufficient validation/allow-listing of the destination that the gateway contacts during this status check. The request destination is either attacker-influenceable or derivable from attacker-controlled inbound content, and the gateway does not restrict the resulting outbound connection to expected/trusted certificate status endpoints. As a result, the gateway can be induced to issue crafted requests to internal or otherwise unintended network destinations.

Two properties of the CVSS vector are consistent with this analysis:

• AV:N / AC:L / PR:N / UI:N: The attack is network-reachable, low complexity, requires no privileges, and no user interaction — matching an unauthenticated, inbound-message-triggered server-side request.
• C:H / I:N / A:H: Strong confidentiality impact (internal service responses/information may be disclosed back to or inferred by the attacker) and high availability impact (the gateway's processing can be disrupted, for example by requests that hang, exhaust resources, or target services whose responses break processing). Integrity is not impacted (I:N), consistent with an SSRF that reads/redirects requests rather than modifying server state directly.

Because the request is issued by the gateway during certificate status verification, the attack surface is the message ingestion path. Any deployment where the Email Protection Gateway processes inbound messages from untrusted/Internet senders is exposed. The "otherwise unintended network destinations" phrasing indicates the gateway is not constrained to a fixed set of certificate status endpoints, enabling redirection toward internal hosts, loopback services, cloud metadata-style endpoints, or other adjacent systems.

Note: The available intelligence does not include source code, function names, parameter names, or the exact OCSP/status-check request format. No implementation-level specifics (URL paths, parameters, or internal functions) are asserted here; the analysis is confined to the vulnerability class (SSRF) and the described mechanism (online certificate status check during inbound message handling).

Exploitation Scenarios

No public PoC or exploit code is available; the attack chain is inferred from the vulnerability class (SSRF) and the mechanism described in the NVD entry.

1. Reconnaissance / target identification An attacker identifies a Kiteworks Email Protection Gateway version below 9.5.0 that processes inbound email. Targets are Internet-facing mail-security gateways, which are frequently enumerable via banner/HTTP fingerprints and TLS certificate metadata (see Shodan dorks). The attacker needs only the ability to send a message that reaches the gateway's inbound processing — an unauthenticated network position (PR:N), not a foothold.

2. Triggering the flaw class The attacker crafts an inbound message that causes the gateway to perform its online certificate status check. During this check the gateway constructs an outbound request to a certificate status destination that is influenceable/derivable from attacker-influenced inbound content. Because the destination is not sufficiently validated or restricted, the attacker redirects the request to an internal or otherwise unintended network target. This is the SSRF trigger (CWE-918): the server, not the attacker, originates the connection.

3. Execution method (at the vulnerability-class level) The request is issued by the gateway itself as part of certificate status verification. The attacker does not execute code; they steer where the server-side request goes. At the class level, SSRF payloads place an attacker-chosen destination (internal IP, internal hostname, loopback, or a network-reachable service) into the field consumed by the status check. No specific parameter, endpoint, or payload syntax is asserted here because the description does not disclose them.

4. Post-exploitation impact

• Confidentiality (C:H): The gateway's requests can reach internal services that are not otherwise externally reachable. Depending on what the gateway can reach and what is reflected/observable, sensitive internal information may be disclosed.
• Availability (A:H): Requests to unintended destinations can disrupt gateway operation (e.g., responses that break message processing, or resource consumption that degrades availability).
• Lateral movement potential: By reaching internal endpoints, the SSRF can serve as a pivot/probe point for mapping the internal network topology that the gateway can access.

No exploitation-in-the-wild, threat actor, or campaign data is available for this CVE.

Impact Assessment

• Base score: 9.1 (Critical) — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H.
• Attack prerequisites: none beyond network reachability to the gateway's inbound message processing. No authentication (PR:N) and no user interaction (UI:N) are required, and complexity is low (AC:L), making this attractive for automated, opportunistic exploitation.
• Confidentiality impact (High): The SSRF allows the gateway to issue crafted requests to internal/unintended destinations, potentially disclosing sensitive internal information reachable from the gateway host or its network segment.
• Availability impact (High): Manipulating the certificate status check can disrupt gateway operation, affecting the email security control plane — potentially delaying or disrupting mail security processing.
• Integrity impact (None per CVSS): Consistent with SSRF read/redirect behavior rather than a direct server-side write.
• Blast radius: Primarily the Email Protection Gateway itself, but the impact extends to any internal service reachable from it (control-plane infrastructure, internal APIs, metadata services, adjacent hosts). Because the gateway sits in the mail path, availability impact can cascade to downstream mail flow/business email processing.

Detection Guidance

Sigma Rule

title: Kiteworks Email Protection Gateway SSRF via Certificate Status Check
id: 8f2b1c4a-9d3e-4b77-a1c0-2026kiteworks
status: experimental
description: Detects SSRF in Kiteworks Email Protection Gateway (<9.5.0) where an inbound message triggers an online certificate status check that results in requests to an unexpected/unintended network destination.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-102104
author: valtersit.com
date: 2026-01-01
logsource:
  category: network_connection
  product: kiteworks
detection:
  selection_process:
    process_name|contains:
      - 'kiteworks'
      - 'emailprotection'
      - 'epg'
  selection_action:
    event_type|contains:
      - 'certificate_status'
      - 'ocsp'
      - 'cert_status_check'
  selection_remote:
    destination_ip|cidr:
      - '127.0.0.0/8'
      - '10.0.0.0/8'
      - '172.16.0.0/12'
      - '192.168.0.0/16'
      - '169.254.0.0/16'
  condition: selection_process and selection_action and selection_remote
falsepositives:
  - Legitimate certificate status checks to authorized internal OCSP responders within RFC1918 space
level: high
tags:
  - attack.t1190
  - cwe.918

YARA Rule

rule CVE_2026_102104_Kiteworks_EPG_SSRF
{
    meta:
        description = "Detects Kiteworks Email Protection Gateway components affected by CVE-2026-102104 (SSRF via certificate status check)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-102104"
        cve = "CVE-2026-102104"
        date = "2026-01-01"

    strings:
        $prod1 = "Email Protection Gateway" ascii nocase
        $prod2 = "Kiteworks" ascii nocase
        $ver1  = "version 9.5.0" ascii nocase
        $epg1  = "epg" ascii wide nocase
        $cert1 = "certificate status" ascii nocase
        $ocsp  = "ocsp" ascii nocase
        $ssrf1 = "certificate_status_check" ascii nocase

    condition:
        (uint16(0) == 0x5A4D or uint32(0) == 0x464C457F) and
        (
            (any of ($prod*)) or
            (any of ($cert1,$ocsp)) or
            ($ssrf1) or
            (any of ($epg*))
        )
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"CVE-2026-102104 Kiteworks Email Protection Gateway SSRF Attempt"; flow:to_server,established; content:"Email Protection Gateway"; http_header; nocase; http.user_agent; content:"Kiteworks"; nocase; classtype:attempted-recon; reference:cve,2026-102104; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-102104; sid:2026102104; rev:1;)

Elastic Detection

sequence by host.name
  [network where network.direction == "outbound" and destination.ip in ("127.0.0.0/8","10.0.0.0/8","172.16.0.0/12","192.168.0.0/16","169.254.0.0/16") and process.name in ("kiteworks","emailprotection","epg")]
  [network where network.direction == "outbound" and network.protocol in ("http","tls") and
     (url.full : "*certificate*" or url.full : "*ocsp*" or http.request.method : "GET")]

Splunk SPL Query

index=kiteworks OR index=email_gateway sourcetype=*epg* OR sourcetype=*kiteworks*
(event_type=certificate_status_check OR message="*certificate status*" OR message="*ocsp*")
| rex field=dest_ip "(?<dip>\d+\.\d+\.\d+\.\d+)"
| where cidrmatch("10.0.0.0/8", dip) OR cidrmatch("172.16.0.0/12", dip) OR cidrmatch("192.168.0.0/16", dip) OR cidrmatch("127.0.0.0/8", dip) OR cidrmatch("169.254.0.0/16", dip)
| stats count values(dip) as internal_destinations by src_user, host, event_type
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="kiteworks,ssrf,web,">
  <rule id="102104" level="12">
    <decoded_as>json</decoded_as>
    <field name="event_type">certificate_status_check</field>
    <description>CVE-2026-102104: Kiteworks EPG certificate status check triggered (potential SSRF)</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cwe_918,ssrf,</group>
  </rule>

  <rule id="102105" level="14">
    <if_sid>102104</if_sid>
    <field name="destination_ip" type="pcre2">^(127\.|10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.|169\.254\.|0\.0\.0\.0)</field>
    <description>CVE-2026-102104: Kiteworks EPG SSRF to internal/unintended destination</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cwe_918,ssrf,internal_pivot,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations

• Upgrade Kiteworks Email Protection Gateway to version 9.5.0 or later. The affected range is "before version 9.5.0," so 9.5.0 is the minimum remediated version per the NVD description.
• If immediate upgrade is not possible, restrict outbound network access from the gateway to only the specific certificate status/OCSP endpoints it legitimately requires. Apply egress filtering (default-deny) so the gateway cannot reach arbitrary internal hosts, loopback, link-local, or cloud metadata ranges (127.0.0.0/8, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 169.254.0.0/16).
• Segment the gateway into a dedicated network zone with least-privilege reachability to internal services.
• Reduce exposure of the inbound message-processing interface where operationally feasible, and monitor for anomalous certificate status check bursts.

2. Patch / upgrade steps

• Identify all Email Protection Gateway instances and confirm versions below 9.5.0.
• Stage and deploy the 9.5.0+ update through change control; validate that certificate status checking functions correctly after upgrade.
• Verify egress restrictions remain enforced post-upgrade as defense in depth.

3. Long-term hardening

• Enforce strict allow-listing of all outbound destinations for security gateways; block RFC1918, loopback, and metadata endpoints by default.
• Adopt network egress monitoring to detect any server-side request to internal ranges.
• Maintain a vulnerability management cadence for Internet-facing mail security infrastructure and apply vendor updates promptly.
• Track the CVE and vendor advisory for any future patch/version metadata, as no tracked source currently provides patch evidence.

References

• NVD — CVE-2026-102104: https://nvd.nist.gov/vuln/detail/CVE-2026-102104
• MITRE CWE-918 (Server-Side Request Forgery): https://cwe.mitre.org/data/definitions/918.html
• Kiteworks Security Advisories / product documentation (Email Protection Gateway 9.5.0 release notes) — vendor advisory URL not provided in supplied data; consult the official Kiteworks site for the corresponding security advisory.
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• CISA KEV Catalog: not applicable — CVE-2026-102104 is NOT listed in CISA KEV as of this report.

Threat actor / exploit-in-the-wild evidence: none available. No PoC, no Nuclei template, no exploit code, and no campaign attribution is associated with this CVE in the supplied intelligence.