CVE-2026-102136

Published: Sep 30, 2026Modified: Oct 13, 2026

6.3

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L

Exploitability: 2.0 / Impact: 3.7

Source: 9119a7d8-5eab-497f-8521-727c672e3725 (Secondary)

Description

In multi-node deployments, an attacker who had already obtained code execution on one appliance node could submit a value through an internal cluster interface that was written into monitoring configuration on another node without sufficient validation, potentially allowing OS commands to be executed there. Execution was limited to an unprivileged service account on that node.

Affected (1)

Products: Accellion: Kiteworks

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Accellion Kiteworks	version < 9.5.1

Related CWEs

Improper Neutralization of CRLF Sequences ('CRLF Injection')

The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.

References (2)

https://github.com/kiteworks/security-advisories/security/advisories/GHSA-rpxx-jm93-w5j7

Source: 9119a7d8-5eab-497f-8521-727c672e3725

Vendor Advisory

https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json

Source: 9119a7d8-5eab-497f-8521-727c672e3725

Broken Link

Timeline

No history available yet.