github.comConfirmation
https://github.com/kiteworks/security-advisories/security/advisories/GHSA-rmfx-6h9w-fq87 CVE-2026-28271
MEDIUM
Kiteworks Core is vulnerable to Server-Side Request Forgery (SSRF)
Record summary
CVE-2026-28271 has a selected CVSS score of 6.5 (medium).
Description
Kiteworks is a private data network (PDN). Prior to version 9.2.0, a vulnerability in Kiteworks configuration functionality allows bypassing of SSRF protections through DNS rebinding attacks. Malicious administrators could exploit this to access internal services that should be restricted. Version 9.2.0 contains a patch for the issue.
Description source: CVE List
Exploitation context
CISA SSVC decision
ExploitationNone
AutomatableNo
Technical impactPartial
CISA Coordinator · SSVC 2.0.3 · Evaluated Mar 3, 2026 · Source: CVE List
Affected products and versions
1| Product | Source | Version range | Status |
|---|---|---|---|
security-advisoriesBrowse kiteworks / security-advisories | CVE List | < 9.2.0 | affected |