CVE-2026-28271
Kiteworks is a private data network (PDN). Prior to version 9.2.0, a vulnerability in Kiteworks configuration functionality allows bypassing of SSRF protections through DNS rebinding attacks. Malicious administrators could exploit this to access internal services that should be restricted. Version 9.2.0 contains a patch for the issue.
Scoring
- Severity
- MEDIUM
- CVSS base score
- 6.5
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
- EPSS probability
- 0.43%
- CWE
- CWE-350, CWE-918
- Published
- 2026-02-27
- Last modified
- 2026-03-12
Affected products
- kiteworks security-advisories
Weakness type
Related vulnerabilities
- CVE-2026-55526 — PraisonAI: SSRF protection bypass in `spider_tools._host_is_blocked()` via DNS-resolved hostnames (`127.0.0.1.nip.io`)
- CVE-2026-56709 — Grav before 3.9.2 Host Header Injection via sendInvitationEmail
- CVE-2026-75514 — BunkerWeb: rDNS bypass via missing forward-confirmation (FCrDNS) in blacklist, greylist, and antibot
- CVE-2026-63118 — MCP Ruby SDK: Streamable HTTP transport lacks DNS-rebinding (Host/Origin) protection
- CVE-2026-55391 — datamodel-code-generator vulnerable to SSRF protection bypass via DNS rebinding
- CVE-2026-46611 — Glances: XML-RPC Server Missing Host Header Validation Enables DNS Rebinding Attack
- CVE-2026-12635 — Reliance on Reverse DNS Resolution for a Security-Critical Action in GitLab
- CVE-2026-42559 — RMCP: DNS rebinding vulnerability in rmcp Streamable HTTP server transport