CVE-2026-102145: Kiteworks Core Server-Side Request Forgery through CRLF Injection

Severity: medium (CVSS 6.6 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-30 · updated 2026-10-13
Weakness: CWE-93

Description

An authenticated administrator could cause the server to issue requests to, and interact with, internal network services that are not meant to be reachable through this interface. On its own this did not result in code execution.

Affected products

Kiteworks Email Protection Gateway: before 9.5.1 — fixed in 9.5.1

How to fix

Upgrade to a fixed version: Kiteworks Email Protection Gateway 9.5.1. Check the vendor advisory for mitigations.

References

https://github.com/kiteworks/security-advisories/security/advisories/GHSA-h97r-j99c-q8xc
https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json

Get alerted when CVE-2026-102145 or the next vulnerability affects your stack