CVE-2026-102102 Kiteworks Email Protection Gateway server-side request forgery
9.1
Analysis on rafaelpfister.ch
- Article · October 31, 2026 totemomail 9.5.1: Account takeover in the Web Portal and SSRF via incoming email fixed totemomail 9.5.1 fixes eight security vulnerabilities and brings totemomail in line with the Kiteworks advisories for Email Protection Gateway published at the end of September. Two vulnerabilities can be exploited without authentication: a flaw in the Web Portal password reset process that allows administrator accounts to be taken over, and server-side retrieval of URLs from incoming messages. The release also includes path traversal fixes in the Admin API and Mail API, as well as updated Tomcat and Batik libraries.
- Article · September 25, 2026 Kiteworks: Vendor Recommends Shutdown on September 26 – What Is Known So Far Kiteworks asked its customers to shut down all systems on Saturday, September 26, 2026, from 4:00 a.m. to 10:00 a.m. Final report: During the shutdown, the vendor found and closed a critical flaw without a CVE; on September 30, 125 advisories followed, including CVE-2026-54154 (CVSS 10.0) in the Email Protection Gateway. Totemomail is not affected.
Vendor description
Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery (SSRF). A server-side request forgery (SSRF) weakness in Kiteworks Email Protection Gateway could allow a remote, unauthenticated attacker to induce the gateway to issue crafted requests to internal or otherwise unintended network destinations. The requests are triggered while the gateway retrieves an issuer certificate in an inbound message. Depending on the services reachable from the gateway, this could disclose sensitive internal information or disrupt gateway operation. Reference data
- Vendor
- Kiteworks
- Affected products
- Email Protection Gateway
- CVSS 3.1
- 9.1 (CRITICAL)
- Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H- Weakness type
- CWE-918: Server-Side Request Forgery
- Published
- September 30, 2026
