CVE-2026-102134

Executive Summary

CVE-2026-102134 is an access-control inconsistency in Kiteworks Core, a secure file transfer and content-governance platform. The product failed to apply its gateway-level API security controls to every request authenticated through the platform's central authentication service, meaning an authenticated user could reach REST API functionality over a request path where those controls — including enforcement of signed-out and revoked sessions — were not applied. The impact is unauthorized access to API functionality and the continued validity of sessions that should have been terminated, scoring 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N).

Technical Analysis

The vulnerability maps to CWE-420: Unprotected Alternate Channel. The core defect is a control-coverage gap rather than a memory-safety or injection bug. Kiteworks Core exposes REST API functionality to authenticated users through its central authentication service. Normally, requests passing through the gateway would have gateway-level API security controls applied to them — the description explicitly states these controls include enforcement of signed-out and revoked sessions. In this case, a request path existed over which those controls were not applied, so an authenticated user could reach REST API functionality without passing the same control checks.

Two distinct consequences follow from the description:

1. Missing gateway-level API security controls. Alternative request paths reached REST API endpoints without the gateway-level controls that would otherwise govern them. This is the classic CWE-420 shape: a secondary/alternate channel that bypasses the checks enforced on the primary channel.

2. No enforcement of signed-out and revoked sessions. Because session-state controls (signed-out, revoked) were among the controls not applied on that path, a session that should have been invalidated could still reach API functionality. This extends the effective lifetime and reachability of a session beyond what the platform intends.

What the public data does not provide: the specific request path, the REST API endpoint(s) affected, the central authentication service's internal naming, the precise gateway component that enforces controls on the normal path, or a version range. No function names, class names, URL endpoints, file paths, or parameter names are given in the NVD Description or CNA Title. Per accuracy constraints, none are invented here. The vulnerability class and mechanism above are the full extent of what the description supports.

The attack surface is the network-facing REST API of Kiteworks Core as reached through the central authentication service. The CVSS vector confirms network reachability (AV:N), no special access conditions beyond the base attack characteristics (AC:L), a low-privileged authenticated actor (PR:L), and no user interaction (UI:N). Confidentiality and Integrity impacts are each Low (C:L/I:L) and Availability impact is None (A:N), with scope unchanged (S:U).

Exploitation Scenarios

The description provides no PoC, no exploit code, and no Nuclei template. The attack chain below is inferred at the vulnerability-class level from the CWE-420 mechanism; no specific endpoint, parameter, or code construct is fabricated.

1. Reconnaissance / target identification. An attacker with valid low-privileged credentials identifies Kiteworks Core instances reachable on the network. Because the flaw is an alternate-channel weakness rather than a remotely unauthenticated bug, the actor must first authenticate — consistent with PR:L. Target identification is limited to locating the platform and confirming the API is reachable.

2. Triggering the flaw class. The actor, already authenticated via the platform's central authentication service, issues REST API requests over the request path on which gateway-level API security controls are not applied. This is the unprotected alternate channel: the same API functionality that would normally be gated is reached through a route that skips those controls. No credential theft, bypass of authentication itself, or memory corruption is required — the authentication step succeeds normally; it is the subsequent control application that is missing.

3. Payload / execution method (vulnerability-class level). At the class level, the actor directs legitimate-looking authenticated API requests down the control-free path. Because signed-out and revoked session enforcement is among the missing controls, a session that the platform believes is terminated can still be used to reach API functionality. No public PoC exists; the request mechanics are inferred from the class, not from disclosed implementation detail.

4. Post-exploitation impact. Successful exploitation yields access to REST API functionality that should have been blocked by the gateway controls, with Low confidentiality and Low integrity impact. Practically, this can mean reading or modifying data exposed by those API operations, and — notably — continuing to operate with a session after sign-out or revocation, which undermines session-invalidation as a containment control. Availability is unaffected (A:N). The attacker remains constrained to what the reached REST API functionality permits and to their authenticated privilege level, which bounds blast radius.

Impact Assessment

The CVSS base score is 5.4 with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N.

• AV:N — reachable over the network, so any instance exposing the relevant API to the network is in scope.
• PR:L — requires a low-privileged authenticated account; it is not an unauthenticated remote compromise.
• UI:N — no victim interaction needed.
• C:L / I:L — limited confidentiality and integrity impact; no availability impact.
• S:U — scope is unchanged; the impact stays within the security authority of the vulnerable component.

Business impact centers on the erosion of two security guarantees: (1) that gateway-level API security controls mediate every authenticated API request, and (2) that signed-out and revoked sessions are no longer usable. Failure of the second guarantee is operationally significant because session revocation is often relied upon for immediate containment of a compromised or departing account. Where that revocation does not take effect on the alternate path, incident-response containment and access offboarding assumptions are weakened.

Affected systems are Kiteworks Core deployments that expose REST API functionality through the central authentication service. Blast radius cannot be scoped by version, because no affected version range has been published by the CNA or NVD, and OSV package data is unavailable. Because the flaw requires authentication, exposure is bounded to the authenticated attack surface rather than the anonymous internet. No CISA KEV listing exists, so there is no confirmed evidence of exploitation in the wild at time of writing.

Detection Guidance

Detection should focus on authenticated REST API requests that reach API functionality through unusual or non-standard request paths, and on API activity attributable to sessions that should have been terminated (post-sign-out or post-revocation). The rules below are templates at the vulnerability-class level; no product-specific endpoint or parameter names were disclosed, so operators must tune them to their environment.

Sigma Rule

title: Kiteworks Core API Access via Unprotected Alternate Channel Patterns
id: 3f9c1b7e-4d2a-4c8e-9a11-7b6e0c5d2f84
status: experimental
description: Detects authenticated REST API requests to Kiteworks Core that may use an alternate request path not subject to gateway-level API security controls, including use of signed-out or revoked sessions.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-102134
author: valtersit.com
date: 2026/01/01
logsource:
  category: webserver
detection:
  selection_product:
    - 'cs-uri-query|contains: "/api/"'
    - 'cs-uri-stem|contains: "/api/"'
  selection_suspicious_path:
    cs-uri-stem|contains:
      - '/api/v'
      - '/rest/'
  filter_normal_gateway:
    cs-uri-stem|startswith: '/gateway/'
  condition: selection_product and selection_suspicious_path and not filter_normal_gateway
falsepositives:
  - Legitimate internal integrations using non-standard API paths
  - Load balancer or reverse-proxy path rewrites
level: medium

YARA Rule

rule CVE_2026_102134_Kiteworks_Unprotected_Channel
{
    meta:
        description = "Detection aid for CVE-2026-102134 - Kiteworks Core API reachable over a path lacking gateway-level security controls"
        author = "valtersit.com"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-102134"
        cwe = "CWE-420"

    strings:
        $api  = "/api/" ascii wide nocase
        $rest = "/rest/" ascii wide nocase
        $auth = "authentication" ascii wide nocase
        $sess = "session" ascii wide nocase
        $revoke = "revoked" ascii wide nocase
        $signout = "signed-out" ascii wide nocase

    condition:
        filesize < 5MB and
        ( $api or $rest ) and
        ( $auth or $sess ) and
        ( $revoke or $signout )
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-102134 Kiteworks Core - API request over non-gateway alternate path"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/api/"; nocase; http.uri; content:!"/gateway/"; nocase; reference:cve,2026-102134; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-102134; classtype:attempted-recon; sid:2026102134; rev:1;)

Elastic Detection

sequence by user.name with maxspan=10m
  [ authentication where event.outcome == "success" and user.name != null ]
  [ network where http.request.method in ("GET","POST","PUT","DELETE") and
      url.path : "/api/*" and
      not url.path : "/gateway/*" ]

Splunk SPL Query

index=web OR index=proxy sourcetype=access_combined
| eval uri=coalesce(uri_path, url)
| where like(uri, "%/api/%") AND NOT like(uri, "%/gateway/%")
| stats count min(_time) as first_seen max(_time) as last_seen
        values(status) as status_codes values(src_ip) as client_ips
        by user, uri
| where count > 5
| convert ctime(first_seen) ctime(last_seen)
| sort - count

Wazuh OSSEC Rule

<group name="kiteworks,api_access_control,">
  <rule id="100134" level="10">
    <decoded_as>json</decoded_as>
    <field name="url">/api/</field>
    <field name="url" negate="yes">/gateway/</field>
    <field name="user" negate="no">\.+</field>
    <description>CVE-2026-102134: Kiteworks Core REST API reached over non-gateway path - possible alternate channel bypass</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>pci_dss_10.2.4,pci_dss_10.2.5,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, workaround, or affected version range is provided in the available data. The following are defensive measures consistent with the vulnerability class; none are vendor-endorsed fixes.

1. Immediate mitigations.

   • Restrict network access to the Kiteworks Core REST API to trusted networks or VPN segments where operationally feasible, reducing reachable attack surface.
   • For accounts or sessions where containment is required, do not rely solely on session revocation within the platform. Where the platform supports it, force re-authentication and, if necessary, disable the affected accounts outright.
   • Review and tighten access to any request paths that terminate at the API but bypass the normal gateway, using a reverse proxy or API gateway in front of Kiteworks to enforce consistent authentication, session validity, and authorization checks on all API-bound requests.
   • Enforce uniform path normalization and canonicalization at the proxy so alternate encodings or path variants cannot sidestep gateway control matching.
   • Monitor for authenticated API requests originating from sessions that have been signed out or revoked.

2. Patch / upgrade steps.

   • No patch or fixed version is available at the time of writing (0/4 patch confidence). Monitor the Kiteworks security advisory channels and NVD for an official CVE entry and fixed release, and apply it promptly once available.
   • Because no affected version range has been published, validate exposure against the vendor advisory once it is released rather than assuming any particular version.

3. Long-term hardening.

   • Ensure all authenticated API traffic is forced through the gateway-level controls, and periodically test that alternate request paths cannot reach API functionality without those controls.
   • Treat session invalidation (sign-out, revocation) as a security boundary and verify it is enforced consistently across every request path.
   • Add regression tests for CWE-420 (Unprotected Alternate Channel) to CI/CD pipelines so that new routes cannot silently bypass gateway controls.

References

• NVD — CVE-2026-102134: https://nvd.nist.gov/vuln/detail/CVE-2026-102134
• CWE-420 — Unprotected Alternate Channel: https://cwe.mitre.org/data/definitions/420.html
• Kiteworks security advisories: https://www.kiteworks.com/security/
• MITRE ATT&CK — T1190 Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE-2026-102134 is not listed as of this report)