Secure Data Forms CVE-2026-102091

Exploitation requires a reachable Kiteworks Secure Data Forms instance (version before 9.5.0) exposed to the attacker's network, and an internal service or network-restricted resource for the forged request to reach - the impact is proportional to what internal targets the server can reach (e.g., cloud metadata services, internal APIs, admin interfaces). No authentication is required (PR:N) and no user interaction (UI:N), so default-configured, internet-facing deployments are directly exploitable. The primary limiting factor is network positioning: the value depends on the SSRF being able to reach sensitive internal-only endpoints; a well-segmented deployment with strict egress filtering blunts the read-back capability.

The vendor CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N, 7.5) describes an unauthenticated, low-complexity, network-reachable SSRF requiring no user interaction - signals that normally warrant priority attention. However, real-world exploitation pressure is currently low: there is no CISA KEV listing, no EPSS score was provided, and no public exploit code was identified, so this is a genuine but not urgently-weaponized issue at time of analysis. NOTABLE CONFLICT: the vendor scored impact as C:N/I:H, yet the description explicitly states the attacker can 'read back the responses' from internal services, which is a confidentiality impact (C:H), not integrity - the vendor's I:H/C:N assignment appears misapplied and should be verified with Kiteworks. The net severity (~7.5) is roughly correct, but the impact dimension is mislabeled. Treat this as a real medium-to-high priority for internet-facing Kiteworks Secure Data Forms deployments because SSRF against unauthenticated endpoints is a common pivot toward internal recon and cloud metadata theft, while noting no evidence of active exploitation exists yet.

An unauthenticated remote attacker sends a crafted request to an internet-facing Kiteworks Secure Data Forms endpoint containing an attacker-controlled URL, causing the server to issue an outbound request to an internal-only target (e.g., a cloud metadata endpoint at 169.254.169.254 or an internal admin service) and return the response body to the attacker. Because no authentication or user interaction is required (PR:N/UI:N) and complexity is low, the attacker can enumerate internal hosts and harvest data from network-restricted resources. No public proof-of-concept exploit was identified at time of analysis.