CVE-2026-102138CWE-918ssrf

CVE-2026-102138

Low · published October 1, 2026

CVSS v3.1
3.3
EPSS
0%
Percentile
6.9
In the wild
Unconfirmed
What it is

An authenticated administrator on a node with an optional, separately licensed gateway role enabled could supply a connector URL that the server retrieved without sufficient validation of its scheme or destination, causing the server to issue requests to internal network services. Exploitation requires the licensed gateway role to be active.

The record
Technical detail
CVSS v3.1
3.3 · LOW
Vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00177 · 6.9th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2026-10-01T01:17Z
Affected products (1)
ProductVersionsFixed in
accellion/kiteworks< 9.5.19.5.1
References (2)
https://github.com/kiteworks/security-advisories/security/advisories/GHSA-q9w9-c5hj-87jm · 9119a7d8-5eab-497f-8521-727c672e3725https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json · 9119a7d8-5eab-497f-8521-727c672e3725
EPSS history
Timeline
  • 02 OCT 03:41Z
    EPSS moved — → 0%
    epss
  • 30 SEP 20:11Z
    Kiteworks Core Server-Side Request Forgery (SSRF)
    cvelistv5