CVE-2026-102138
Last modified
CVE-2026-102138 is a low-severity vulnerability rated 3.3/10 on the CVSS scale. An authenticated administrator on a node with an optional, separately licensed gateway role enabled could supply a connector URL that the server retrieved without sufficient validation of its scheme or destination, causing the server to issue requests to internal network services. Exploitation requires the licensed gateway role to be active..
Description
An authenticated administrator on a node with an optional, separately licensed gateway role enabled could supply a connector URL that the server retrieved without sufficient validation of its scheme or destination, causing the server to issue requests to internal network services. Exploitation requires the licensed gateway role to be active.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Kiteworks | Core | < 9.5.1 |
References
Timeline
- Published
- Last Modified
- Status
- Awaiting Analysis
Frequently Asked Questions
What is CVE-2026-102138?
How severe is CVE-2026-102138?
How do I fix CVE-2026-102138?
How Strix Helps
- One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-102132An administrative import function in Kiteworks Core did not …7.2
- CVE-2026-102133An optional, separately licensed repository-connector featur…6.6
- CVE-2026-102134Kiteworks Core did not apply its gateway-level API security …5.4
- CVE-2026-102135On a Kiteworks Email Protection Gateway cluster with databas…6.6
- CVE-2026-102136In multi-node deployments, an attacker who had already obtai…6.3
- CVE-2026-102137An authenticated administrator could bypass the content vali…4.1
- CVE-2026-102139An authorization check in the large file exchange feature of…6.5
- CVE-2026-10214A weakness has been identified in zhayujie chatgpt-on-wechat…7.3
- CVE-2026-102140An authenticated administrator could initiate an administrat…4.9
- CVE-2026-102141Two Kiteworks Core cluster-management operations did not val…6.7
- CVE-2026-102142A system notification template on the Kiteworks appliance wa…7.2
- CVE-2026-102143An unauthenticated attacker could cause a file with attacker…7.5
Are you affected by CVE-2026-102138?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST