All vulnerabilities
CVE-2026-102091GHSA-m8mj-m4fv-jmrh

Kiteworks Secure Data Forms server-side request forgery

Kiteworks Secure Data Forms
Open in ThreatlineRecord JSON
CVSS
7.5High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.32%Chance of exploitation activity in the next 30 days, higher than 23% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in9.5.0Fixed versionCVE List
Published30 Sep 2026Updated 2 Oct 2026CVE List

What fixes it

  • 9.5.0Secure Data FormsCVE List
  • 9.5.0Kiteworks Secure Data Forms, otherGitHub

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Kiteworks Secure Data Forms before version 9.5.0 is vulnerable to Server-Side Request Forgery that could allow an unauthenticated, remote attacker to make the server issue arbitrary outbound network requests and read back the responses. This could potentially be used to reach internal-only services or other network-restricted resources.

Text from CVE List

Affected versions 3

  • Secure Data Formsaffected: all versions before 9.5.0CVE List
  • Secure Data Formsunaffected: 9.5.0CVE List
  • Kiteworks Secure Data Forms, other< 9.5.0GitHub

References 2