EN PT-BR
← Voltar ao feed
high

mailcow discloses five flaws, including cross-tenant RCE via domain footer template, with public PoC steps

1 fonte(s) · 1 atualização(ões) · publicado 10/11/2026 11:45 · coletado há 2 horas

On 2026-11-10 the mailcow team published five security advisories for mailcow-dockerized, its open-source mail server suite, with full write-ups and proof-of-concept steps. The most severe, CVE-2026-125757 (CVSS 9.1 as reported by the article), lets a single domain admin run code inside the rspamd container that scans mail for every tenant on the server. The other four flaws are stored XSS in admin log tables, XSS from a mailbox Full name that reaches the super admin, SMTP injection through quarantine release, and unlimited password guessing. Fixes shipped in releases 2026-07a and 2026-11, and the article reports no exploitation in the wild. The vendor's GitHub Security Advisories and the 2026-11 release page could not be opened during research, so the severity values and version ranges rest on the article and should be checked against those pages; the article also names CVE-2026-125757 while stating that no CVE IDs have been assigned yet.

Entenda a falha

A vulnerabilidade

The most severe flaw, CVE-2026-125757 (CVSS 9.1 per the article), is in mailcow-dockerized. A domain admin can set a domain-wide email footer that rspamd renders as a Jinja template, and a sandbox gap lets template code reach system commands inside the rspamd container shared by all tenants. The attacker needs a domain admin account and gets code execution across tenants. Four more flaws were disclosed: stored XSS in admin log tables via mail headers with no account needed (GHSA-xrq6-h4qm-x38v, 8.3), a domain admin to super admin XSS through the mailbox Full name (GHSA-76cm-26jx-jmhr, 8.1), SMTP injection on quarantine release (GHSA-5928-v56c-g8x5, 7.4) and unlimited password guessing (GHSA-rpvp-3pw9-3vcw, 7.4). The footer RCE and brute-force flaws affect versions before 2026-11, and the other three affect versions before 2026-07a. Update to 2026-11 or later. The article says no CVE IDs are assigned yet while naming one.

Como funciona

A domain admin saves a domain-wide footer in mailcow. When any outbound message from that domain passes through rspamd, it renders the footer as a Jinja template. Because the template engine's sandbox has a gap, template code can reach system commands instead of only producing text. That code runs inside the rspamd container, which scans mail for every domain on the server, so it is not limited to the admin's own tenant.

Por que é vulnerável

The root cause of the RCE is that admin-controlled input is rendered as a template by an engine whose sandbox does not fully block access to system commands. The article does not detail the fix for this flaw or why it went unnoticed. For the others, it names unescaped output (log tables, Full name field, with no Content-Security-Policy), missing dot-stuffing in the default raw quarantine release format, and failed logins logged as 127.0.0.1, which netfilter ignores, so no bans happened.

Onde está

The articles name no file or function; the flaw is in the domain footer feature rendered by rspamd, and the other four are tracked in the mailcow GitHub advisories GHSA-xrq6-h4qm-x38v, GHSA-76cm-26jx-jmhr, GHSA-5928-v56c-g8x5 and GHSA-rpvp-3pw9-3vcw.

Como foi descoberta

The articles do not say who found the flaws or how. The mailcow team published five security advisories on 2026-11-10 with full technical write-ups, and fixes shipped in releases 2026-07a and 2026-11. The article reports no exploitation in the wild so far. The vendor's advisory pages could not be opened during research, so details rest on the article.

PoC pública

The article says the advisories include full write-ups and proof-of-concept steps for each of the five flaws, so reproduction details are public. The articles do not describe how mature the PoCs are or give a repository. Since attackers now have a roadmap, patch quickly, especially if you host multiple tenants, even though no exploitation has been seen.

Explicação gerada por IA a partir da matéria e dos artigos, em 10/11/2026 13:18.

Detalhes técnicos

  • Cross-tenant RCE via footer template (CVE-2026-125757, CVSS 9.1): a domain admin sets a domain-wide email footer, which rspamd renders as a Jinja template on every outbound message. A sandbox gap in the template engine lets template code reach system commands, and the code runs in the shared rspamd container. The article quotes an advisory warning that a tenant admin can read, modify and inject every tenant's mail in transit and disable filtering platform-wide.
  • Stored XSS in admin log tables (GHSA-xrq6-h4qm-x38v, CVSS 8.3): no account is needed. The attacker places script in a mail header such as Message-ID, and it runs in the admin's session when the Rspamd history or Ratelimits log is opened.
  • Domain admin to super admin (GHSA-76cm-26jx-jmhr, CVSS 8.1): a domain admin plants script in a mailbox Full name field, which the super admin's Mailboxes page renders without escaping. mailcow ships no Content-Security-Policy, so the script can take over the instance.
  • SMTP injection in quarantine release (GHSA-5928-v56c-g8x5, CVSS 7.4): the default raw release format skipped dot-stuffing, so a crafted quarantined message can inject SMTP commands when a user releases it. Injected mail bypasses spam and virus filters and can relay from the server's IP address.
  • Unlimited password guessing (GHSA-rpvp-3pw9-3vcw, CVSS 7.4): failed ActiveSync, CalDAV/CardDAV and autodiscover logins were logged as 127.0.0.1, which netfilter ignores, so attackers were never banned. Autodiscover also revealed which mailboxes exist and their owner names.

Remediação

  • Update mailcow-dockerized to release 2026-11 or later, which covers all five flaws. The article lists the footer RCE and brute-force flaws as fixed before 2026-11, and the log XSS, Full name XSS and SMTP injection flaws as fixed before 2026-07a.
  • If an update is not possible yet, set the quarantine release format to "attachment" to block the SMTP injection.
  • The team states there is no workaround for the brute-force issue.
  • Review domain admin accounts and recent footer changes for unexpected template code.

Linha do tempo

  1. securityonline.info ↗ · pub. 10/11/2026 11:45 · coletado 10/11 13:01 primeiro registro

    mailcow discloses five flaws, including cross-tenant RCE via domain footer template, with public PoC steps

    ler a análise desta fonte

    On 2026-11-10 the mailcow team published five security advisories for mailcow-dockerized, its open-source mail server suite, with full write-ups and proof-of-concept steps. The most severe, CVE-2026-125757 (CVSS 9.1 as reported by the article), lets a single domain admin run code inside the rspamd container that scans mail for every tenant on the server. The other four flaws are stored XSS in admin log tables, XSS from a mailbox Full name that reaches the super admin, SMTP injection through quarantine release, and unlimited password guessing. Fixes shipped in releases 2026-07a and 2026-11, and the article reports no exploitation in the wild. The vendor's GitHub Security Advisories and the 2026-11 release page could not be opened during research, so the severity values and version ranges rest on the article and should be checked against those pages; the article also names CVE-2026-125757 while stating that no CVE IDs have been assigned yet.

    Technical Details

    • Cross-tenant RCE via footer template (CVE-2026-125757, CVSS 9.1): a domain admin sets a domain-wide email footer, which rspamd renders as a Jinja template on every outbound message. A sandbox gap in the template engine lets template code reach system commands, and the code runs in the shared rspamd container. The article quotes an advisory warning that a tenant admin can read, modify and inject every tenant's mail in transit and disable filtering platform-wide.
    • Stored XSS in admin log tables (GHSA-xrq6-h4qm-x38v, CVSS 8.3): no account is needed. The attacker places script in a mail header such as Message-ID, and it runs in the admin's session when the Rspamd history or Ratelimits log is opened.
    • Domain admin to super admin (GHSA-76cm-26jx-jmhr, CVSS 8.1): a domain admin plants script in a mailbox Full name field, which the super admin's Mailboxes page renders without escaping. mailcow ships no Content-Security-Policy, so the script can take over the instance.
    • SMTP injection in quarantine release (GHSA-5928-v56c-g8x5, CVSS 7.4): the default raw release format skipped dot-stuffing, so a crafted quarantined message can inject SMTP commands when a user releases it. Injected mail bypasses spam and virus filters and can relay from the server's IP address.
    • Unlimited password guessing (GHSA-rpvp-3pw9-3vcw, CVSS 7.4): failed ActiveSync, CalDAV/CardDAV and autodiscover logins were logged as 127.0.0.1, which netfilter ignores, so attackers were never banned. Autodiscover also revealed which mailboxes exist and their owner names.

    Remediation

    • Update mailcow-dockerized to release 2026-11 or later, which covers all five flaws. The article lists the footer RCE and brute-force flaws as fixed before 2026-11, and the log XSS, Full name XSS and SMTP injection flaws as fixed before 2026-07a.
    • If an update is not possible yet, set the quarantine release format to "attachment" to block the SMTP injection.
    • The team states there is no workaround for the brute-force issue.
    • Review domain admin accounts and recent footer changes for unexpected template code.