CVE-2026-28271 — Kiteworks Core is vulnerable to Server-Side Request Forgery (SSRF)
Kiteworks is a private data network (PDN). Prior to version 9.2.0, a vulnerability in Kiteworks configuration functionality allows bypassing of SSRF protections through DNS rebi…
Published: 2026-02-27 · CVSS: 6.5 · CVSS 3.1
Kiteworks is a private data network (PDN). Prior to version 9.2.0, a vulnerability in Kiteworks configuration functionality allows bypassing of SSRF protections through DNS rebinding attacks. Malicious administrators could exploit this to access internal services that should be restricted. Version 9.2.0 contains a patch for the issue.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7