CVE-2026-22689

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-22689", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-01-08T19:23:09.854Z", "datePublished": "2026-01-10T05:46:13.771Z", "dateUpdated": "2026-01-12T16:47:34.722Z"}, "containers": {"cna": {"title": "Mailpit is vulnerable to Cross-Site WebSocket Hijacking (CSWSH) allowing unauthenticated access to emails", "problemTypes": [{"descriptions": [{"cweId": "CWE-1385", "lang": "en", "description": "CWE-1385: Missing Origin Validation in WebSockets", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/axllent/mailpit/security/advisories/GHSA-524m-q5m7-79mm", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/axllent/mailpit/security/advisories/GHSA-524m-q5m7-79mm"}, {"name": "https://github.com/axllent/mailpit/commit/6f1f4f34c98989fd873261018fb73830b30aec3f", "tags": ["x_refsource_MISC"], "url": "https://github.com/axllent/mailpit/commit/6f1f4f34c98989fd873261018fb73830b30aec3f"}], "affected": [{"vendor": "axllent", "product": "mailpit", "versions": [{"version": "< 1.28.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-10T05:46:13.771Z"}, "descriptions": [{"lang": "en", "value": "Mailpit is an email testing tool and API for developers. Prior to version 1.28.2, the Mailpit WebSocket server is configured to accept connections from any origin. This lack of Origin header validation introduces a Cross-Site WebSocket Hijacking (CSWSH) vulnerability. An attacker can host a malicious website that, when visited by a developer running Mailpit locally, establishes a WebSocket connection to the victim's Mailpit instance (default ws://localhost:8025). This allows the attacker to intercept sensitive data such as email contents, headers, and server statistics in real-time. This issue has been patched in version 1.28.2."}], "source": {"advisory": "GHSA-524m-q5m7-79mm", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-12T16:47:26.726768Z", "id": "CVE-2026-22689", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-12T16:47:34.722Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-22689", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-12T16:47:26.726768Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-12T16:47:32.112Z"}}], "cna": {"title": "Mailpit is vulnerable to Cross-Site WebSocket Hijacking (CSWSH) allowing unauthenticated access to emails", "source": {"advisory": "GHSA-524m-q5m7-79mm", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "axllent", "product": "mailpit", "versions": [{"status": "affected", "version": "< 1.28.2"}]}], "references": [{"url": "https://github.com/axllent/mailpit/security/advisories/GHSA-524m-q5m7-79mm", "name": "https://github.com/axllent/mailpit/security/advisories/GHSA-524m-q5m7-79mm", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/axllent/mailpit/commit/6f1f4f34c98989fd873261018fb73830b30aec3f", "name": "https://github.com/axllent/mailpit/commit/6f1f4f34c98989fd873261018fb73830b30aec3f", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Mailpit is an email testing tool and API for developers. Prior to version 1.28.2, the Mailpit WebSocket server is configured to accept connections from any origin. This lack of Origin header validation introduces a Cross-Site WebSocket Hijacking (CSWSH) vulnerability. An attacker can host a malicious website that, when visited by a developer running Mailpit locally, establishes a WebSocket connection to the victim's Mailpit instance (default ws://localhost:8025). This allows the attacker to intercept sensitive data such as email contents, headers, and server statistics in real-time. This issue has been patched in version 1.28.2."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1385", "description": "CWE-1385: Missing Origin Validation in WebSockets"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-10T05:46:13.771Z"}}}, "cveMetadata": {"cveId": "CVE-2026-22689", "state": "PUBLISHED", "dateUpdated": "2026-01-12T16:47:34.722Z", "dateReserved": "2026-01-08T19:23:09.854Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-01-10T05:46:13.771Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "mailpit", "vendor": "axllent", "versions": [{"status": "affected", "version": "< 1.28.2"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:axllent:mailpit:*:*:*:*:*:*:*:*", "matchCriteriaId": "D35BCA11-BA2A-4A42-9488-7A39F44D3AF2", "versionEndExcluding": "1.28.2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Mailpit is an email testing tool and API for developers. Prior to version 1.28.2, the Mailpit WebSocket server is configured to accept connections from any origin. This lack of Origin header validation introduces a Cross-Site WebSocket Hijacking (CSWSH) vulnerability. An attacker can host a malicious website that, when visited by a developer running Mailpit locally, establishes a WebSocket connection to the victim's Mailpit instance (default ws://localhost:8025). This allows the attacker to intercept sensitive data such as email contents, headers, and server statistics in real-time. This issue has been patched in version 1.28.2."}, {"lang": "es", "value": "Mailpit es una herramienta de prueba de correo electr\u00f3nico y API para desarrolladores. Antes de la versi\u00f3n 1.28.2, el servidor WebSocket de Mailpit est\u00e1 configurado para aceptar conexiones desde cualquier origen. Esta falta de validaci\u00f3n del encabezado Origin introduce una vulnerabilidad de Cross-Site WebSocket Hijacking (CSWSH). Un atacante puede alojar un sitio web malicioso que, cuando es visitado por un desarrollador que ejecuta Mailpit localmente, establece una conexi\u00f3n WebSocket con la instancia de Mailpit de la v\u00edctima (por defecto ws://localhost:8025). Esto permite al atacante interceptar datos sensibles como el contenido de los correos electr\u00f3nicos, los encabezados y las estad\u00edsticas del servidor en tiempo real. Este problema ha sido parcheado en la versi\u00f3n 1.28.2."}], "id": "CVE-2026-22689", "lastModified": "2026-06-17T10:20:14.330", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-22689", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-12T16:47:26.726768Z", "version": "2.0.3"}}]}, "published": "2026-01-10T06:15:51.900", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/axllent/mailpit/commit/6f1f4f34c98989fd873261018fb73830b30aec3f"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "url": "https://github.com/axllent/mailpit/security/advisories/GHSA-524m-q5m7-79mm"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-1385"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T07:10:07.997767+00:00", "value": {"mitigation_remediation": ["Upgrade Mailpit to version 1.28.2 or newer to enforce Origin header validation.", "If an upgrade is not immediately possible, restrict the WebSocket endpoint to the localhost interface only and block incoming connections from external sources using a firewall or host\u2011based access controls.", "Consider disabling the WebSocket API entirely in environments where Mailpit runs in production or on untrusted networks."], "summary": {"action": "Apply Patch", "impact": "Unauthenticated real\u2011time interception of email contents via WebSocket hijacking."}, "threat_synthesis": {"affected_systems": "The vulnerability affects the axllent Mailpit product. Versions earlier than 1.28.2 are impacted, including any build that incorporates the pre\u20111.28.2 WebSocket server configuration that does not validate the Origin header. Newer releases from 1.28.2 onward have the fix.", "description_and_impact": "A local installation of the email testing tool Mailpit is vulnerable to Cross\u2011Site WebSocket Hijacking because the server accepts connections from any origin. This flaw allows a malicious website to force a developer to open a WebSocket to the local Mailpit instance; the attacker can then read every email, header, and statistic streamed by the server in real time. No authentication is required, and the data is not obfuscated, so attackers obtain full confidentiality of all traffic sent through the server.", "risk_and_exploitability": "CVSS scoring of 6.5 indicates a medium severity; the EPSS score of <1% implies a low likelihood of exploitation in the wild. The flaw is not listed as a known exploited vulnerability in the KEV catalog. Attackers can exploit the issue by hosting a malicious page that a developer inadvertently visits while running Mailpit locally, establishing an unauthenticated WebSocket connection and harvesting sensitive data. The attack requires no prior access and leverages the lack of Origin validation on the server."}}}}, "created": "2026-04-18T07:15:25.855646+00:00", "updated": "2026-04-18T07:15:25.855658+00:00", "vendors": []}