CVE-2026-102120

8.8 HIGHpublic exploit available

Published 2026-09-30 · Updated 2026-10-01

AI risk analysis

Summary: This vulnerability allows an attacker with code execution on one node to escalate privileges and run commands with elevated permissions on another node in the same Kiteworks cluster, leading to full control over the cluster.
Exploitability: Exploitation requires existing code execution on one node and is moderately difficult due to the need for internal cluster management function access.
Blast radius: If exploited, the attacker could gain full control over the entire Kiteworks cluster, potentially leading to data loss, service disruption, and unauthorized access.
Detection: No reliable host or network indicator is derivable from the published description.
Prioritized remediation: Upgrade to Kiteworks 3.1.2 or later.

rceprivilege-escalationclusterinternal

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

A privilege escalation vulnerability in Kiteworks could have allowed an attacker who had already obtained code execution on one node of a clustered Kiteworks deployment to run operating system commands with elevated privileges on another node of the same cluster. Insufficient input validation in an internal cluster management function let attacker-supplied values reach a privileged execution context; exploitation requires existing access to a node in the cluster, and the affected function is not reachable from outside the cluster.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Weaknesses

CWE-78, CWE-269

Public exploit & PoC references

https://github.com/kiteworks/security-advisories/security/advisories/GHSA-m968-434m-rgwp

All references

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

Related by shared AI tags and CWE weakness class. Browse the full archive.