CVE-2026-102095

Name of the Vulnerable Software and Affected Versions Kiteworks Email Protection Gateway versions prior to 9.5.0

Description An issue exists where the system performs server-side fetches of URLs found within processed message content without sufficient destination restrictions. This allows a remote, unauthenticated sender to craft messages that force the gateway to send requests to internal services and cloud instance metadata endpoints. The system then returns the responses, which can lead to the disclosure of sensitive internal data or alter the state of the reached internal services. This is a Server-Side Request Forgery (SSRF), a flaw where an attacker induces a server-side application to make requests to an unintended location.

Recommendations Update Kiteworks Email Protection Gateway to version 9.5.0 or later.