Kiteworks Core CVE-2026-102138

Requires (1) valid authenticated administrator access to a Kiteworks Core node, and (2) the optional, separately-licensed gateway role to be enabled and active on that node - explicitly not a default configuration. Exploitation is limited by these two prerequisites plus the SSRF's constrained impact (limited confidentiality and integrity, no availability impact). Affects Kiteworks Core versions before 9.5.1; fixed in 9.5.1. The connector-URL retrieval performs insufficient validation of URL scheme and destination.

This is a genuinely low-priority SSRF despite being network-reachable. The CVSS vector (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N, base 3.3) is doubly gated: PR:H means the attacker must already be an authenticated administrator, and AC:H reflects that the optional, separately-licensed gateway role must be enabled - a non-default deployment condition explicitly stated in the description. Impact is limited to C:L/I:L/A:N, i.e. probing/limited access to internal services rather than full internal data theft or code execution. No EPSS score, no CISA KEV listing, and no public exploit code were provided, so this is 'no public exploit identified at time of analysis' - consistent with a targeted, low-yield issue rather than a mass-exploitation candidate. SSVC signals are absent from the input. The scenario is realistic (SSRF against internal network services) but the prerequisites (admin credentials AND a licensed, activated gateway role) make it a post-compromise pivot tool, not an initial-access threat. No conflicting signals: the vendor's low score is well-justified by the description.

An attacker who has already obtained administrator credentials on a Kiteworks Core node that has the optional licensed gateway role active configures a connector with a URL pointing at an internal service (e.g. a metadata endpoint or internal admin interface). The server retrieves the URL without validating its scheme or destination, issuing attacker-directed requests into the internal network and returning or acting on limited responses. No public proof-of-concept was identified.