CVE-2026-21859

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-21859", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-01-05T16:44:16.367Z", "datePublished": "2026-01-07T23:24:07.869Z", "dateUpdated": "2026-01-08T19:23:22.033Z"}, "containers": {"cna": {"title": "Mailpit Proxy Endpoint is Vulnerable to Server-Side Request Forgery (SSRF)", "problemTypes": [{"descriptions": [{"cweId": "CWE-918", "lang": "en", "description": "CWE-918: Server-Side Request Forgery (SSRF)", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/axllent/mailpit/security/advisories/GHSA-8v65-47jx-7mfr", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/axllent/mailpit/security/advisories/GHSA-8v65-47jx-7mfr"}, {"name": "https://github.com/axllent/mailpit/commit/3b9b470c093b3d20b7d751722c1c24f3eed2e19d", "tags": ["x_refsource_MISC"], "url": "https://github.com/axllent/mailpit/commit/3b9b470c093b3d20b7d751722c1c24f3eed2e19d"}], "affected": [{"vendor": "axllent", "product": "mailpit", "versions": [{"version": "< 1.28.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-07T23:24:07.869Z"}, "descriptions": [{"lang": "en", "value": "Mailpit is an email testing tool and API for developers. Versions 1.28.0 and below have a Server-Side Request Forgery (SSRF) vulnerability in the /proxy endpoint, allowing attackers to make requests to internal network resources. The /proxy endpoint validates http:// and https:// schemes, but it does not block internal IP addresses, enabling attackers to access internal services and APIs. This vulnerability is limited to HTTP GET requests with minimal headers. The issue is fixed in version 1.28.1."}], "source": {"advisory": "GHSA-8v65-47jx-7mfr", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/axllent/mailpit/security/advisories/GHSA-8v65-47jx-7mfr", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-08T19:23:19.174824Z", "id": "CVE-2026-21859", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-08T19:23:22.033Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-21859", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-08T19:23:19.174824Z"}}}], "references": [{"url": "https://github.com/axllent/mailpit/security/advisories/GHSA-8v65-47jx-7mfr", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-08T19:23:13.440Z"}}], "cna": {"title": "Mailpit Proxy Endpoint is Vulnerable to Server-Side Request Forgery (SSRF)", "source": {"advisory": "GHSA-8v65-47jx-7mfr", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "axllent", "product": "mailpit", "versions": [{"status": "affected", "version": "< 1.28.1"}]}], "references": [{"url": "https://github.com/axllent/mailpit/security/advisories/GHSA-8v65-47jx-7mfr", "name": "https://github.com/axllent/mailpit/security/advisories/GHSA-8v65-47jx-7mfr", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/axllent/mailpit/commit/3b9b470c093b3d20b7d751722c1c24f3eed2e19d", "name": "https://github.com/axllent/mailpit/commit/3b9b470c093b3d20b7d751722c1c24f3eed2e19d", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Mailpit is an email testing tool and API for developers. Versions 1.28.0 and below have a Server-Side Request Forgery (SSRF) vulnerability in the /proxy endpoint, allowing attackers to make requests to internal network resources. The /proxy endpoint validates http:// and https:// schemes, but it does not block internal IP addresses, enabling attackers to access internal services and APIs. This vulnerability is limited to HTTP GET requests with minimal headers. The issue is fixed in version 1.28.1."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-918", "description": "CWE-918: Server-Side Request Forgery (SSRF)"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-07T23:24:07.869Z"}}}, "cveMetadata": {"cveId": "CVE-2026-21859", "state": "PUBLISHED", "dateUpdated": "2026-01-08T19:23:22.033Z", "dateReserved": "2026-01-05T16:44:16.367Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-01-07T23:24:07.869Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "mailpit", "vendor": "axllent", "versions": [{"status": "affected", "version": "< 1.28.1"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:axllent:mailpit:*:*:*:*:*:*:*:*", "matchCriteriaId": "AEB660CD-DB82-43AE-A1A8-7A4724C1967F", "versionEndExcluding": "1.28.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Mailpit is an email testing tool and API for developers. Versions 1.28.0 and below have a Server-Side Request Forgery (SSRF) vulnerability in the /proxy endpoint, allowing attackers to make requests to internal network resources. The /proxy endpoint validates http:// and https:// schemes, but it does not block internal IP addresses, enabling attackers to access internal services and APIs. This vulnerability is limited to HTTP GET requests with minimal headers. The issue is fixed in version 1.28.1."}, {"lang": "es", "value": "Mailpit es una herramienta de prueba de correo electr\u00f3nico y una API para desarrolladores. Las versiones 1.28.0 e inferiores tienen una vulnerabilidad de falsificaci\u00f3n de petici\u00f3n del lado del servidor (SSRF) en el endpoint /proxy, permitiendo a los atacantes realizar peticiones a recursos de la red interna. El endpoint /proxy valida los esquemas http:// y https://, pero no bloquea las direcciones IP internas, lo que permite a los atacantes acceder a servicios y API internas. Esta vulnerabilidad est\u00e1 limitada a peticiones HTTP GET con encabezados m\u00ednimos. El problema est\u00e1 solucionado en la versi\u00f3n 1.28.1."}], "id": "CVE-2026-21859", "lastModified": "2026-06-17T10:19:02.623", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-21859", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-08T19:23:19.174824Z", "version": "2.0.3"}}]}, "published": "2026-01-08T00:16:00.150", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/axllent/mailpit/commit/3b9b470c093b3d20b7d751722c1c24f3eed2e19d"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/axllent/mailpit/security/advisories/GHSA-8v65-47jx-7mfr"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/axllent/mailpit/security/advisories/GHSA-8v65-47jx-7mfr"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-918"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T16:46:35.572322+00:00", "value": {"mitigation_remediation": ["Upgrade Mailpit to version 1.28.1 or later, which removes the SSRF weakness.", "If the proxy feature is not required, remove or disable the /proxy endpoint from the service configuration.", "Implement network or application\u2011level controls to restrict outbound connections from Mailpit to approved external hosts, ensuring internal addresses remain unreachable."], "summary": {"action": "Apply Patch", "impact": "Server-side request forgery (SSRF) via the /proxy endpoint"}, "threat_synthesis": {"affected_systems": "All axllent Mailpit releases up to and including 1.28.0 are vulnerable; the issue was fixed in 1.28.1, and any deployment of that version or newer is no longer affected.", "description_and_impact": "Mailpit, an email testing and API tool, contains a flaw in its /proxy endpoint that allows a server\u2011side request forgery attack; an attacker can submit an HTTP or HTTPS URL and the endpoint forwards the request without validating the target. This enables indirect access to internal network services, restricted APIs, or data that would otherwise be unreachable from the public Internet. The vulnerability is identified as CWE\u2011918 and is limited to HTTP GET requests with minimal headers.", "risk_and_exploitability": "The CVSS score of 5.8 indicates moderate severity while the EPSS score of 1% suggests a low but non\u2011zero exploitation probability. The CVE description does not specify whether authentication is required to use the /proxy endpoint, so it is unclear whether an unauthenticated attacker can trigger the SSRF without credentials. The SSRF flaw nevertheless allows an attacker who can reach the Mailpit server to perform internal reconnaissance, lateral movement, or to access internal services or APIs that would otherwise be inaccessible from the public Internet. The vulnerability is not listed in the CISA KEV catalog, reducing automated alerting but not eliminating the risk."}}}}, "created": "2026-04-18T17:00:05.559935+00:00", "updated": "2026-04-18T17:00:05.559960+00:00", "vendors": []}