CVE-2026-28271: Accellion Kiteworks SSRF Vulnerability

CVE-2026-28271 Overview

CVE-2026-28271 is a Server-Side Request Forgery (SSRF) vulnerability in Kiteworks private data network (PDN) that allows attackers to bypass SSRF protections through DNS rebinding attacks. Prior to version 9.2.0, the configuration functionality in Kiteworks contains insufficient validation that enables malicious administrators to circumvent security controls designed to restrict access to internal services.

DNS rebinding attacks exploit the time-based nature of DNS resolution, allowing an attacker to first resolve a hostname to a legitimate external IP address during initial validation, then quickly rebind it to an internal IP address when the actual request is made. This technique effectively bypasses IP-based SSRF protections.

Critical Impact

Malicious administrators could exploit this vulnerability to access internal services that should be restricted, potentially exposing sensitive internal infrastructure, databases, and other backend services not intended to be accessible through the Kiteworks application.

Affected Products

• Accellion Kiteworks versions prior to 9.2.0

Discovery Timeline

• 2026-02-27 - CVE CVE-2026-28271 published to NVD
• 2026-03-04 - Last updated in NVD database

Technical Details for CVE-2026-28271

Vulnerability Analysis

This vulnerability (CWE-350: Reliance on Reverse DNS Resolution for a Security-Critical Action) exists within the configuration functionality of Kiteworks. The application implements SSRF protections that validate URLs and hostnames to prevent requests to internal network resources. However, these protections rely on DNS resolution at validation time without accounting for subsequent DNS changes.

DNS rebinding exploits the gap between when a hostname is validated and when the actual network request is made. An attacker controlling a malicious DNS server can configure extremely short TTL (Time-To-Live) values, causing the hostname to resolve to different IP addresses across the validation and request phases.

The impact is significant for organizations using Kiteworks to handle sensitive file transfers and communications. Successful exploitation requires high privileges (administrator access) but can lead to high confidentiality and integrity impacts by accessing internal services that should remain isolated from the Kiteworks application layer.

Root Cause

The root cause is the reliance on DNS resolution at a single point in time for security validation. The application validates hostnames against SSRF blocklists by resolving them to IP addresses and checking if those IPs fall within restricted ranges. However, DNS resolution is performed separately when the actual HTTP request is made, creating a time-of-check to time-of-use (TOCTOU) condition. Attackers can exploit this window by configuring DNS records to change between the validation and request phases.

Attack Vector

The attack requires an adversary with administrative privileges on the Kiteworks platform. The attacker would configure a URL pointing to a hostname under their control. When the application validates this URL, the attacker's DNS server responds with a legitimate external IP address, passing SSRF validation checks. When Kiteworks subsequently makes the actual request to that hostname, the DNS server responds with an internal IP address (such as 127.0.0.1 or internal RFC 1918 addresses), causing the request to reach internal services.

This attack vector is classified as network-based, requiring no user interaction but necessitating high privileges to access the vulnerable configuration functionality.

Detection Methods for CVE-2026-28271

Indicators of Compromise

• Unusual DNS queries with extremely low TTL values from the Kiteworks server
• Configuration changes involving external URLs that resolve to internal IP addresses
• Outbound requests to internal services from the Kiteworks application that do not match expected behavior
• Administrator activity configuring URLs pointing to suspicious or newly registered domains

Detection Strategies

• Monitor DNS resolution patterns from Kiteworks servers for anomalous TTL values or rapid IP address changes
• Implement network monitoring to detect requests from Kiteworks to internal services that should not be accessible
• Audit administrator configuration changes, particularly those involving external URL endpoints
• Deploy DNS monitoring solutions to track resolution discrepancies between validation and request times

Monitoring Recommendations

• Enable detailed logging on Kiteworks configuration changes and track all URL-based configurations
• Implement network segmentation monitoring to detect unauthorized cross-segment communications
• Deploy DNS query logging on internal DNS servers to identify rebinding patterns
• Configure alerts for Kiteworks outbound connections to internal IP ranges

How to Mitigate CVE-2026-28271

Immediate Actions Required

• Upgrade Kiteworks to version 9.2.0 or later immediately
• Review administrator accounts for unauthorized or suspicious users
• Audit recent configuration changes for potentially malicious URL entries
• Implement network segmentation to limit the impact of SSRF attacks

Patch Information

Kiteworks version 9.2.0 contains a patch for this vulnerability. Organizations should upgrade to this version or later to remediate CVE-2026-28271. For detailed information about the security fix, refer to the Kiteworks Security Advisory.

Workarounds

• Restrict administrative access to trusted personnel only and implement multi-factor authentication for admin accounts
• Deploy network-level controls to prevent the Kiteworks application from reaching internal services directly
• Implement DNS pinning at the network level to prevent rebinding attacks where possible
• Monitor and restrict outbound connections from Kiteworks servers using firewall rules