CVE-2026-102141

Executive Summary

CVE-2026-102141 is a path validation vulnerability (CWE-73: External Control of File Name or Path) affecting two cluster-management operations in Kiteworks Core. An attacker who already holds root-level access on one node of a Kiteworks cluster can leverage the absence of file-path validation to write arbitrary files as root onto another node in the same cluster and cause those files to be executed remotely. The vulnerability is rated CVSS 6.7 and is currently unpatched across all tracked sources. Exploitation is constrained by two preconditions: the attacker must already possess backend root access on a cluster node, and a pending software patch must be present on the target node.

Technical Analysis

CVE-2026-102141 stems from a failure to validate file paths supplied to two distinct cluster-management operations within Kiteworks Core. The vulnerability class — CWE-73, External Control of File Name or Path — describes a condition in which a software component accepts a filename or path from an external source and uses it without adequate sanitization or validation. In this specific case, the affected operations are part of the cluster-management subsystem, which is responsible for coordinating state and distributing software artifacts between nodes in a Kiteworks Core cluster deployment.

The attack surface is the cluster-management interface. These operations are backend-privileged mechanisms, which is consistent with the CVSS vector's PR:H (High privileges required) and AV:L (Local attack vector) components. The S:C (Changed scope) metric indicates that exploitation crosses a security boundary — in this case, from one cluster node to another — which is a defining characteristic of the flaw. Because the two operations do not validate the paths supplied to them, an attacker with root on a source node can direct file-write operations toward a destination node, writing files with root privileges on that destination.

The I:H (High integrity impact) subscore reflects that the attacker can write arbitrary files as root, enabling modification of system binaries, configuration files, scheduled tasks, or application code. The C:L (Low confidentiality) and A:L (Low availability) subscores indicate that while the primary impact is integrity compromise through root-level file writes and subsequent execution, some confidentiality and availability effects may follow from executing attacker-controlled content on the target node.

A critical gating condition is the requirement for a pending software patch on the target node. The NVD description explicitly states that exploitation requires "a pending software patch present on the target node." This suggests the vulnerable code path is exercised during patch distribution or staging operations within the cluster-management workflow. When a patch is pending, the cluster-management operations handle patch-related files and may accept path inputs that are not properly validated. This narrows the exploitation window: the attacker must act while a patch is staged or pending on the target.

No public proof-of-concept, exploit code, or Nuclei template exists for this vulnerability. No affected version range has been published, and no patch reference is available. The technical description does not disclose specific function names, API endpoints, parameters, or file paths involved in the two cluster-management operations.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class and the NVD description. It does not name any function, endpoint, or parameter not present in the source description.

1) Reconnaissance / Target Identification The attacker must first gain root-level access on at least one node of a Kiteworks Core cluster. This is a significant precondition — it implies the attacker has already achieved a high-privilege compromise through a separate vector, or is a malicious insider with backend administrative access. From the compromised node, the attacker enumerates the cluster topology to identify other reachable nodes and determines whether any of them have a pending software patch. The presence of a pending patch is the trigger condition; without it, the vulnerable code path is not exercised.

2) Triggering the Flaw Class The attacker invokes one of the two cluster-management operations that handle file paths without validation. Because these operations accept externally controlled path input, the attacker supplies a path that causes a file to be written to the target node rather than — or in addition to — the intended location on the local node. The path-traversal / arbitrary-path nature of CWE-73 means the attacker can direct the write to a location of their choosing on the remote node, subject to the privileges of the cluster-management operation (root, per the description).

3) Payload / Execution Method The attacker writes a file as root onto the target node via the unvalidated path. Because the file is written with root privileges and the vulnerability description states the attacker can "cause them to be executed there," the attacker places the written content at a location that the node will execute — for example, a path that is consumed by the pending patch process or otherwise executed as part of normal node operation. The exact execution mechanism (scheduled task, patch hook, service restart, startup script) is not specified in the available data and should not be assumed. At the vulnerability-class level, this is an arbitrary file write leading to remote code execution on the target node.

4) Post-Exploitation Impact Successful exploitation yields root-level code execution on the target cluster node. From there, the attacker can pivot across the cluster, disable or tamper with security controls, exfiltrate data stored on the node, or establish persistence. The scope change (S:C) means the compromise extends beyond the originally exploited component to encompass the target node and potentially the wider cluster.

Impact Assessment

The business impact of CVE-2026-102141 is significant for organizations running multi-node Kiteworks Core clusters. Kiteworks is a secure file sharing and governance platform, so nodes in a cluster typically handle sensitive content, credentials, and integration secrets. A root-level remote code execution on a cluster node can expose or corrupt that content and can serve as a pivot point for further intrusion.

The blast radius is constrained by two factors: first, the attacker must already have root on a source node; second, a patch must be pending on the target. These constraints reduce the population of viable targets but do not eliminate the risk — particularly in environments where patch staging windows are common and where a single node compromise can be leveraged to escalate to cluster-wide control.

The CVSS vector CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:H/A:L yields a base score of 6.7 (Medium). The high integrity subscore (I:H) reflects the arbitrary root file write; the changed scope (S:C) reflects the cross-node boundary crossing; the high attack complexity (AC:H) and high privileges required (PR:H) reflect the preconditions. The local attack vector (AV:L) reflects that the attacker starts from a position within the cluster's backend network or on a node.

Detection Guidance

Detection for this vulnerability is challenging because the malicious activity occurs over inter-node cluster-management channels, which are often trusted and encrypted. The most reliable detections focus on unexpected file writes to execution-relevant locations on cluster nodes, unusual inter-node file transfer activity during patch windows, and anomalous process execution by cluster-management service accounts.

Sigma Rule

title: Suspicious Root File Write to Execution Path on Kiteworks Cluster Node via Cluster-Management Operation
id: 8f3a1c2e-7b4d-4e9a-9c1f-2d6e8a5b0f31
status: experimental
description: Detects root-owned file creation or modification in execution-relevant directories on a Kiteworks Core cluster node, potentially indicating exploitation of CVE-2026-102141 via unvalidated cluster-management file paths.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-102141
author: valtersit.com
date: 2026/05/19
tags:
  - attack.privilege_escalation
  - attack.t1068
  - cve.2026-102141
logsource:
  category: file_event
  product: linux
detection:
  selection_paths:
    TargetFilename|startswith:
      - '/etc/cron.d/'
      - '/etc/cron.hourly/'
      - '/etc/cron.daily/'
      - '/etc/systemd/system/'
      - '/usr/local/bin/'
      - '/opt/kiteworks/'
  selection_user:
    User|contains: 'kiteworks'
    User: 'root'
  condition: selection_paths and selection_user
falsepositives:
  - Legitimate package or patch installation by configuration management
  - Authorized cluster patch deployment
level: medium

YARA Rule

rule CVE_2026_102141_Kiteworks_Cluster_Arbitrary_File_Write
{
    meta:
        description = "Detects scripts or payloads consistent with post-exploitation staging of CVE-2026-102141 in Kiteworks Core cluster environments"
        author = "valtersit.com"
        date = "2026-05-19"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-102141"
        cve = "CVE-2026-102141"

    strings:
        $s1 = "kiteworks" nocase
        $s2 = "cluster" nocase
        $s3 = "pending patch" nocase
        $s4 = "node" nocase
        $p1 = "/etc/cron" ascii
        $p2 = "/etc/systemd" ascii
        $p3 = "chmod +x" ascii

    condition:
        uint32(0) == 0x464c457f or
        (2 of ($s*) and 1 of ($p*))
}

Suricata IDS Rule

alert tcp $HOME_NET any -> $HOME_NET any (msg:"CVE-2026-102141 Kiteworks Core Cluster Management Unvalidated File Path Exploitation Attempt"; flow:established,to_server; content:"kiteworks"; nocase; content:"cluster"; nocase; content:"patch"; nocase; content:"/etc/"; nocase; threshold:type limit, track by_src, count 1, seconds 60; classtype:attempted-admin; reference:cve,2026-102141; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-102141; sid:2026102141; rev:1;)

Elastic Detection

sequence by process.entity_id with maxspan=30s
  [process where process.name == "cp" or process.name == "mv" or process.name == "rsync"]
  [file where file.path : ("/etc/cron.d/*", "/etc/systemd/system/*", "/usr/local/bin/*") and file.owner == "root" and process.parent.name : "*kiteworks*"]

Splunk SPL Query

index=linux_logs sourcetype=linux_audit OR sourcetype=sysmon_linux
(auid=0 OR uid=0)
(action="write" OR "create")
path="/etc/cron*" OR path="/etc/systemd/system*" OR path="/opt/kiteworks*" OR path="/usr/local/bin*")
| search process_name="*kiteworks*" OR parent_process="*cluster*"
| stats count min(_time) as first_seen max(_time) as last_seen by host, path, process_name, parent_process
| where count > 0
| eval first_seen=strftime(first_seen, "%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen, "%Y-%m-%d %H:%M:%S")
| sort - count

Wazuh OSSEC Rule

<group name="kiteworks,cve-2026-102141,">
  <rule id="100641" level="12">
    <if_sid>550</if_sid>
    <field name="file">/etc/cron|/etc/systemd/system|/opt/kiteworks|/usr/local/bin</field>
    <field name="uid">0</field>
    <description>CVE-2026-102141: Root-owned file written to execution path on Kiteworks cluster node - possible exploitation of unvalidated cluster-management file path</description>
    <mitre>
      <id>T1068</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, workaround, or affected-version range has been published.

1) Immediate mitigations

• Restrict root access on all Kiteworks Core cluster nodes to the smallest possible set of accounts and enforce privileged access management (PAM) with session recording.
• Segment inter-node cluster-management traffic so that a single compromised node cannot reach management operations on peer nodes unnecessarily.
• Monitor and tightly control the patch staging process; do not leave patches in a pending state longer than operationally required, since a pending patch is a precondition for exploitation.
• Apply file-integrity monitoring to execution-relevant directories (/etc/cron.*, /etc/systemd/system, /usr/local/bin, Kiteworks installation directories) on all cluster nodes.
• Audit root-owned file creation events across the cluster and alert on writes originating from cluster-management service accounts to execution paths.

2) Patch / upgrade steps

• No patch is currently available. Monitor the Kiteworks security advisory channel and the NVD entry for CVE-2026-102141 for the release of a fixed version.
• When a vendor fix is released, test it in a staging cluster before production rollout, then apply it to all nodes — prioritizing nodes that routinely stage patches.

3) Long-term hardening

• Adopt a principle-of-least-privilege model for cluster-management operations; avoid running them as root where a dedicated service account with limited file-write scope would suffice.
• Implement application-layer path validation as a defense-in-depth control in any custom cluster tooling, and require vendors to document path canonicalization guarantees.
• Enforce mTLS and strong authentication between cluster nodes so that a compromised node cannot trivially impersonate a peer.
• Integrate patch management with change control so that pending patches are tracked, limited in duration, and audited.

References

• NVD — CVE-2026-102141: https://nvd.nist.gov/vuln/detail/CVE-2026-102141
• MITRE CWE-73 — External Control of File Name or Path: https://cwe.mitre.org/data/definitions/73.html
• MITRE ATT&CK T1068 — Exploitation for Privilege Escalation: https://attack.mitre.org/techniques/T1068/
• FIRST EPSS — not yet scored for CVE-2026-102141 at time of writing: https://api.first.org/data/v1/epss?cve=CVE-2026-102141
• CISA Known Exploited Vulnerabilities Catalog — CVE-2026-102141 not listed: https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No threat actor campaigns or exploit-in-the-wild evidence have been observed for CVE-2026-102141. No public PoC, exploit code, or Nuclei template is available. The EPSS score has not yet been assigned by FIRST.org, and the CVE is not present in the CISA KEV catalog.