CVE-2026-102091 is a Server-Side Request Forgery (SSRF) vulnerability in Kiteworks Secure Data Forms prior to version 9.5.0. An unauthenticated remote attacker can exploit this flaw to make the server issue arbitrary outbound network requests and read the responses. This could potentially be leveraged to access internal-only services or other network-restricted resources that are otherwise inaccessible externally. The vulnerability is identified as CWE-918 and has a CVSS v3.1 base score of 7.5, indicating high severity. The input data does not include vendor advisory or patch information.

An unauthenticated remote attacker can exploit this SSRF vulnerability to make the affected server send arbitrary outbound requests and read their responses. This may allow the attacker to reach internal or network-restricted services that are not normally accessible, potentially leading to information disclosure or further network reconnaissance. The CVSS vector indicates no confidentiality impact but high integrity impact, and no availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix information is provided, users should monitor the vendor's communications for updates and consider restricting outbound requests from the affected server as a temporary mitigation if feasible.