CVE-2026-102095 Kiteworks Email Protection Gateway server-side request forgery
9.1
Analysis on rafaelpfister.ch
- Article · October 31, 2026 totemomail 9.5.1: Account takeover in the Web Portal and SSRF via incoming email fixed totemomail 9.5.1 fixes eight security vulnerabilities and brings totemomail in line with the Kiteworks advisories for Email Protection Gateway published at the end of September. Two vulnerabilities can be exploited without authentication: a flaw in the Web Portal password reset process that allows administrator accounts to be taken over, and server-side retrieval of URLs from incoming messages. The release also includes path traversal fixes in the Admin API and Mail API, as well as updated Tomcat and Batik libraries.
- Article · September 25, 2026 Kiteworks: Vendor Recommends Shutdown on September 26 – What Is Known So Far Kiteworks asked its customers to shut down all systems on Saturday, September 26, 2026, from 4:00 a.m. to 10:00 a.m. Final report: During the shutdown, the vendor found and closed a critical flaw without a CVE; on September 30, 125 advisories followed, including CVE-2026-54154 (CVSS 10.0) in the Email Protection Gateway. Totemomail is not affected.
Vendor description
Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery. Kiteworks Email Protection Gateway performed server-side fetches of URLs contained in the message content it processed, without adequately restricting the fetch destination. A remote, unauthenticated sender could craft a message that caused the gateway to issue requests to internal services and cloud instance metadata endpoints and return the responses, potentially disclosing sensitive internal data and, depending on the internal service reached, affecting its state. Reference data
- Vendor
- Kiteworks
- Affected products
- Email Protection Gateway
- CVSS 3.1
- 9.1 (CRITICAL)
- Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N- Weakness type
- CWE-918: Server-Side Request Forgery
- Published
- September 30, 2026
