CVE-2026-102136

Analyzed Analyzed - Analysis Complete

Command Injection in Appliance Cluster Interface

Publication date: 2026-09-30

Last updated on: 2026-10-13

Assigner: Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government

Description

In multi-node deployments, an attacker who had already obtained code execution on one appliance node could submit a value through an internal cluster interface that was written into monitoring configuration on another node without sufficient validation, potentially allowing OS commands to be executed there. Execution was limited to an unprivileged service account on that node.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-30

Last Modified

2026-10-13

Generated

2026-10-19

AI Q&A

2026-10-01

EPSS Evaluated

2026-10-18

NVD

CVE-2026-102136

EUVD

EUVD-2026-90279

Affected Vendors & Products

Vendor	Product	Version / Range
accellion	kiteworks	to 9.5.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-93	The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.

Attack-Flow Graph

Executive Summary

This vulnerability allows an attacker with code execution on one node in a multi-node system to send a specially crafted value through an internal cluster interface. This value is then written to the monitoring configuration on another node without proper validation, potentially enabling the execution of operating system commands. The impact is limited to an unprivileged service account on the affected node.

Detection Guidance

Detection requires checking for unauthorized command execution attempts via monitoring configuration files. Inspect internal cluster interfaces for suspicious values submitted to configuration endpoints. Review logs for OS command execution by unprivileged service accounts on nodes.

Impact Analysis

If exploited, this vulnerability could allow an attacker to run unauthorized commands on a node where they only have limited access. This could lead to further compromise of the system, data exfiltration, or disruption of services within the cluster.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by allowing unauthorized code execution on a node with an unprivileged service account. This may lead to data breaches or unauthorized access to sensitive information, violating confidentiality and integrity requirements under these regulations.

Mitigation Strategies

Isolate affected nodes to prevent lateral movement. Review and restrict access to internal cluster interfaces. Validate all inputs submitted through these interfaces to prevent command injection. Monitor for unusual activity in monitoring configurations.

Hi! I’m here to help you understand CVE-2026-102136. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70