CVE-2026-27808

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-27808", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-02-24T02:31:33.267Z", "datePublished": "2026-02-25T23:51:20.365Z", "dateUpdated": "2026-02-26T15:47:56.826Z"}, "containers": {"cna": {"title": "Mailpit is Vulnerable to Server-Side Request Forgery (SSRF) via Link Check API", "problemTypes": [{"descriptions": [{"cweId": "CWE-918", "lang": "en", "description": "CWE-918: Server-Side Request Forgery (SSRF)", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/axllent/mailpit/security/advisories/GHSA-mpf7-p9x7-96r3", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/axllent/mailpit/security/advisories/GHSA-mpf7-p9x7-96r3"}, {"name": "https://github.com/axllent/mailpit/commit/10ad4df8cc0cd9e51dea1b4410009545eef7fbf5", "tags": ["x_refsource_MISC"], "url": "https://github.com/axllent/mailpit/commit/10ad4df8cc0cd9e51dea1b4410009545eef7fbf5"}, {"name": "https://github.com/axllent/mailpit/releases/tag/v1.29.2", "tags": ["x_refsource_MISC"], "url": "https://github.com/axllent/mailpit/releases/tag/v1.29.2"}], "affected": [{"vendor": "axllent", "product": "mailpit", "versions": [{"version": "< 1.29.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-25T23:51:20.365Z"}, "descriptions": [{"lang": "en", "value": "Mailpit is an email testing tool and API for developers. Prior to version 1.29.2, the Link Check API (/api/v1/message/{ID}/link-check) is vulnerable to Server-Side Request Forgery (SSRF). The server performs HTTP HEAD requests to every URL found in an email without validating target hosts or filtering private/internal IP addresses. The response returns status codes and status text per link, making this a non-blind SSRF. In the default configuration (no authentication on SMTP or API), this is fully exploitable remotely with zero user interaction. This is the same class of vulnerability that was fixed in the HTML Check API (CVE-2026-23845 / GHSA-6jxm-fv7w-rw5j) and the screenshot proxy (CVE-2026-21859 / GHSA-8v65-47jx-7mfr), but the Link Check code path was not included in either fix. Version 1.29.2 fixes this vulnerability."}], "source": {"advisory": "GHSA-mpf7-p9x7-96r3", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/axllent/mailpit/security/advisories/GHSA-mpf7-p9x7-96r3", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-26T15:47:50.457289Z", "id": "CVE-2026-27808", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-26T15:47:56.826Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-27808", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-26T15:47:50.457289Z"}}}], "references": [{"url": "https://github.com/axllent/mailpit/security/advisories/GHSA-mpf7-p9x7-96r3", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-26T15:47:42.967Z"}}], "cna": {"title": "Mailpit is Vulnerable to Server-Side Request Forgery (SSRF) via Link Check API", "source": {"advisory": "GHSA-mpf7-p9x7-96r3", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "axllent", "product": "mailpit", "versions": [{"status": "affected", "version": "< 1.29.2"}]}], "references": [{"url": "https://github.com/axllent/mailpit/security/advisories/GHSA-mpf7-p9x7-96r3", "name": "https://github.com/axllent/mailpit/security/advisories/GHSA-mpf7-p9x7-96r3", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/axllent/mailpit/commit/10ad4df8cc0cd9e51dea1b4410009545eef7fbf5", "name": "https://github.com/axllent/mailpit/commit/10ad4df8cc0cd9e51dea1b4410009545eef7fbf5", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/axllent/mailpit/releases/tag/v1.29.2", "name": "https://github.com/axllent/mailpit/releases/tag/v1.29.2", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Mailpit is an email testing tool and API for developers. Prior to version 1.29.2, the Link Check API (/api/v1/message/{ID}/link-check) is vulnerable to Server-Side Request Forgery (SSRF). The server performs HTTP HEAD requests to every URL found in an email without validating target hosts or filtering private/internal IP addresses. The response returns status codes and status text per link, making this a non-blind SSRF. In the default configuration (no authentication on SMTP or API), this is fully exploitable remotely with zero user interaction. This is the same class of vulnerability that was fixed in the HTML Check API (CVE-2026-23845 / GHSA-6jxm-fv7w-rw5j) and the screenshot proxy (CVE-2026-21859 / GHSA-8v65-47jx-7mfr), but the Link Check code path was not included in either fix. Version 1.29.2 fixes this vulnerability."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-918", "description": "CWE-918: Server-Side Request Forgery (SSRF)"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-25T23:51:20.365Z"}}}, "cveMetadata": {"cveId": "CVE-2026-27808", "state": "PUBLISHED", "dateUpdated": "2026-02-26T15:47:56.826Z", "dateReserved": "2026-02-24T02:31:33.267Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-02-25T23:51:20.365Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "mailpit", "vendor": "axllent", "versions": [{"status": "affected", "version": "< 1.29.2"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:axllent:mailpit:*:*:*:*:*:*:*:*", "matchCriteriaId": "24EB3804-DA8E-43E1-82F0-0E365C797AAD", "versionEndExcluding": "1.29.2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Mailpit is an email testing tool and API for developers. Prior to version 1.29.2, the Link Check API (/api/v1/message/{ID}/link-check) is vulnerable to Server-Side Request Forgery (SSRF). The server performs HTTP HEAD requests to every URL found in an email without validating target hosts or filtering private/internal IP addresses. The response returns status codes and status text per link, making this a non-blind SSRF. In the default configuration (no authentication on SMTP or API), this is fully exploitable remotely with zero user interaction. This is the same class of vulnerability that was fixed in the HTML Check API (CVE-2026-23845 / GHSA-6jxm-fv7w-rw5j) and the screenshot proxy (CVE-2026-21859 / GHSA-8v65-47jx-7mfr), but the Link Check code path was not included in either fix. Version 1.29.2 fixes this vulnerability."}, {"lang": "es", "value": "Mailpit es una herramienta de prueba de correo electr\u00f3nico y API para desarrolladores. Antes de la versi\u00f3n 1.29.2, la API de verificaci\u00f3n de enlaces (Link Check API) (/api/v1/message/{ID}/link-check) es vulnerable a la falsificaci\u00f3n de petici\u00f3n del lado del servidor (SSRF). El servidor realiza peticiones HTTP HEAD a cada URL encontrada en un correo electr\u00f3nico sin validar los hosts de destino ni filtrar las direcciones IP privadas/internas. La respuesta devuelve c\u00f3digos de estado y texto de estado por enlace, lo que la convierte en una SSRF no ciega. En la configuraci\u00f3n predeterminada (sin autenticaci\u00f3n en SMTP o API), esto es totalmente explotable de forma remota con cero interacci\u00f3n del usuario. Esta es la misma clase de vulnerabilidad que se corrigi\u00f3 en la API de verificaci\u00f3n de HTML (HTML Check API) (CVE-2026-23845 / GHSA-6jxm-fv7w-rw5j) y el proxy de captura de pantalla (CVE-2026-21859 / GHSA-8v65-47jx-7mfr), pero la ruta de c\u00f3digo de verificaci\u00f3n de enlaces (Link Check) no se incluy\u00f3 en ninguna de las correcciones. La versi\u00f3n 1.29.2 corrige esta vulnerabilidad."}], "id": "CVE-2026-27808", "lastModified": "2026-06-17T10:27:43.150", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.6, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 4.0, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-27808", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-26T15:47:50.457289Z", "version": "2.0.3"}}]}, "published": "2026-02-26T00:16:26.013", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/axllent/mailpit/commit/10ad4df8cc0cd9e51dea1b4410009545eef7fbf5"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/axllent/mailpit/releases/tag/v1.29.2"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/axllent/mailpit/security/advisories/GHSA-mpf7-p9x7-96r3"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/axllent/mailpit/security/advisories/GHSA-mpf7-p9x7-96r3"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-918"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.29.2)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "mailpit", "source": "cna", "vendor": "axllent"}, "product": "mailpit", "vendor": "axllent"}], "analysis": {"en": {"generated_at": "2026-04-17T14:40:14.569945+00:00", "value": {"mitigation_remediation": ["Deploy version\u202f1.29.2 or later of Mailpit to eliminate the SSRF flaw.", "If upgrading is delayed, disable the /api/v1/message/{ID}/link\u2011check endpoint or restrict its exposure so only trusted clients can invoke it.", "Enable or enforce API authentication so that only authenticated users can access the link\u2011check functionality.", "Implement network segmentation or firewall rules that block outbound HTTP HEAD requests from the Mailpit server to private or internal IP ranges.", "Continuously monitor application logs for unexpected HEAD requests or SSRF\u2011style activity and alert on suspicious patterns."], "summary": {"action": "Patch", "impact": "Server\u2011Side Request Forgery (non\u2011blind SSRF)"}, "threat_synthesis": {"affected_systems": "The flaw affects axllent Mailpit deployments running any version prior to 1.29.2. In installations that have no SMTP or API authentication enabled, the /api/v1/message/{ID}/link\u2011check endpoint is fully exposed and can be accessed from any network source.", "description_and_impact": "Mailpit\u2019s Link Check API performs HTTP HEAD requests to all URLs found in an email without validating target hosts or filtering internal/private IP addresses. The API returns the status code and reason phrase for each link, making the vulnerability non\u2011blind. An unauthenticated remote attacker can therefore probe internal or privileged services, obtain status information, and potentially use the endpoint for further reconnaissance or denial\u2011of\u2011service attempts.", "risk_and_exploitability": "The vulnerability has a CVSS score of 5.8, indicating moderate severity, and an EPSS score of less than 1\u202f%, reflecting a low probability of exploitation. The feature is not listed in the CISA Known Exploited Vulnerabilities catalog. The attack vector is remote, requires no special conditions, and the endpoint returns useful information, so the practical risk is higher than the low EPSS would otherwise suggest."}}}}, "created": "2026-02-26T13:10:29.255997+00:00", "updated": "2026-04-17T14:45:21.034604+00:00", "vendors": ["axllent", "axllent$PRODUCT$mailpit"]}