CVE-2026-45709

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-45709", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-13T04:38:01.166Z", "datePublished": "2026-07-20T14:37:00.607Z", "dateUpdated": "2026-07-20T19:08:08.066Z"}, "containers": {"cna": {"title": "Mailpit has an incomplete fix for GHSA-6jxm: HTML check still permits SSRF to private/loopback/IMDS via missing IP-filter dialer", "problemTypes": [{"descriptions": [{"cweId": "CWE-918", "lang": "en", "description": "CWE-918: Server-Side Request Forgery (SSRF)", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/axllent/mailpit/security/advisories/GHSA-j3fj-qppj-fmmc", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/axllent/mailpit/security/advisories/GHSA-j3fj-qppj-fmmc"}, {"name": "https://github.com/axllent/mailpit/releases/tag/v1.30.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/axllent/mailpit/releases/tag/v1.30.0"}], "affected": [{"vendor": "axllent", "product": "mailpit", "versions": [{"version": ">= 1.28.3, < 1.30.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-20T14:38:23.444Z"}, "descriptions": [{"lang": "en", "value": "Mailpit is an email testing tool and API for developers. The fix for GHSA-6jxm-fv7w-rw5j (CVE-2026-23845, \"Server-Side Request Forgery (SSRF) via HTML Check API\"), shipped in mailpit `v1.28.3`, hardened `internal/htmlcheck/css.go::downloadCSSToBytes` with a 5MB size cap, a `text/css` content-type check, login-info stripping in `isValidURL`, and an opt-in `--block-remote-css-and-fonts` config flag \u2014 but did not add the IP-filtering dialer that the same codebase already uses on the two sister SSRF endpoints (the proxy handler and link-check). Prior to version 1.30.0, `internal/htmlcheck/css.go::newSafeHTTPClient` is mis-named \u2014 it builds an `http.Client` whose `Transport.DialContext` calls `net.Dialer.DialContext` directly with no IP allowlisting. As a result, the SSRF originally reported by Bao Anh Phan still permits the server to dial loopback, private, link-local, and any other reserved/multicast range, provided the target replies with `HTTP/200` and a content-type beginning with `text/css`. With redirect-following (`CheckRedirect` allows redirects to any `isValidURL` URL with no IP filter), an attacker-controlled public site can redirect mailpit's request into the private network without ever appearing in the email's HTML. In the default mailpit deploy (no UI auth, no SMTP auth, port 1025/8025 exposed), this is an unauthenticated, network-reachable SSRF triggered by sending an HTML email and then issuing one HTTP `GET` to `/api/v1/message/{id}/html-check`. Version 1.30.0 contains an updated fix."}], "source": {"advisory": "GHSA-j3fj-qppj-fmmc", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-20T19:01:39.446033Z", "id": "CVE-2026-45709", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-20T19:08:08.066Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-45709", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-20T19:01:39.446033Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-20T19:01:40.331Z"}}], "cna": {"title": "Mailpit has an incomplete fix for GHSA-6jxm: HTML check still permits SSRF to private/loopback/IMDS via missing IP-filter dialer", "source": {"advisory": "GHSA-j3fj-qppj-fmmc", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "axllent", "product": "mailpit", "versions": [{"status": "affected", "version": ">= 1.28.3, < 1.30.0"}]}], "references": [{"url": "https://github.com/axllent/mailpit/security/advisories/GHSA-j3fj-qppj-fmmc", "name": "https://github.com/axllent/mailpit/security/advisories/GHSA-j3fj-qppj-fmmc", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/axllent/mailpit/releases/tag/v1.30.0", "name": "https://github.com/axllent/mailpit/releases/tag/v1.30.0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Mailpit is an email testing tool and API for developers. The fix for GHSA-6jxm-fv7w-rw5j (CVE-2026-23845, \"Server-Side Request Forgery (SSRF) via HTML Check API\"), shipped in mailpit `v1.28.3`, hardened `internal/htmlcheck/css.go::downloadCSSToBytes` with a 5MB size cap, a `text/css` content-type check, login-info stripping in `isValidURL`, and an opt-in `--block-remote-css-and-fonts` config flag \u2014 but did not add the IP-filtering dialer that the same codebase already uses on the two sister SSRF endpoints (the proxy handler and link-check). Prior to version 1.30.0, `internal/htmlcheck/css.go::newSafeHTTPClient` is mis-named \u2014 it builds an `http.Client` whose `Transport.DialContext` calls `net.Dialer.DialContext` directly with no IP allowlisting. As a result, the SSRF originally reported by Bao Anh Phan still permits the server to dial loopback, private, link-local, and any other reserved/multicast range, provided the target replies with `HTTP/200` and a content-type beginning with `text/css`. With redirect-following (`CheckRedirect` allows redirects to any `isValidURL` URL with no IP filter), an attacker-controlled public site can redirect mailpit's request into the private network without ever appearing in the email's HTML. In the default mailpit deploy (no UI auth, no SMTP auth, port 1025/8025 exposed), this is an unauthenticated, network-reachable SSRF triggered by sending an HTML email and then issuing one HTTP `GET` to `/api/v1/message/{id}/html-check`. Version 1.30.0 contains an updated fix."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-918", "description": "CWE-918: Server-Side Request Forgery (SSRF)"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-20T14:38:23.444Z"}}}, "cveMetadata": {"cveId": "CVE-2026-45709", "state": "PUBLISHED", "dateUpdated": "2026-07-20T19:08:08.066Z", "dateReserved": "2026-05-13T04:38:01.166Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-07-20T14:37:00.607Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "mailpit", "vendor": "axllent", "versions": [{"status": "affected", "version": ">= 1.28.3, < 1.30.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:axllent:mailpit:*:*:*:*:*:*:*:*", "matchCriteriaId": "9A926FB6-37C0-4810-A70C-97FD072553D3", "versionEndExcluding": "1.30.0", "versionStartIncluding": "1.28.3", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Mailpit is an email testing tool and API for developers. The fix for GHSA-6jxm-fv7w-rw5j (CVE-2026-23845, \"Server-Side Request Forgery (SSRF) via HTML Check API\"), shipped in mailpit `v1.28.3`, hardened `internal/htmlcheck/css.go::downloadCSSToBytes` with a 5MB size cap, a `text/css` content-type check, login-info stripping in `isValidURL`, and an opt-in `--block-remote-css-and-fonts` config flag \u2014 but did not add the IP-filtering dialer that the same codebase already uses on the two sister SSRF endpoints (the proxy handler and link-check). Prior to version 1.30.0, `internal/htmlcheck/css.go::newSafeHTTPClient` is mis-named \u2014 it builds an `http.Client` whose `Transport.DialContext` calls `net.Dialer.DialContext` directly with no IP allowlisting. As a result, the SSRF originally reported by Bao Anh Phan still permits the server to dial loopback, private, link-local, and any other reserved/multicast range, provided the target replies with `HTTP/200` and a content-type beginning with `text/css`. With redirect-following (`CheckRedirect` allows redirects to any `isValidURL` URL with no IP filter), an attacker-controlled public site can redirect mailpit's request into the private network without ever appearing in the email's HTML. In the default mailpit deploy (no UI auth, no SMTP auth, port 1025/8025 exposed), this is an unauthenticated, network-reachable SSRF triggered by sending an HTML email and then issuing one HTTP `GET` to `/api/v1/message/{id}/html-check`. Version 1.30.0 contains an updated fix."}, {"lang": "es", "value": "Mailpit es una herramienta de prueba de correo electr\u00f3nico y API para desarrolladores. La correcci\u00f3n para GHSA-6jxm-fv7w-rw5j (CVE-2026-23845, \u2019Falsificaci\u00f3n de petici\u00f3n del lado del servidor (SSRF) a trav\u00e9s de la API de verificaci\u00f3n de HTML\u2019), incluida en mailpit \u2019v1.28.3\u2019, reforz\u00f3 \u2019internal/htmlcheck/css.go::downloadCSSToBytes\u2019 con un l\u00edmite de tama\u00f1o de 5MB, una verificaci\u00f3n de tipo de contenido \u2019text/css\u2019, la eliminaci\u00f3n de informaci\u00f3n de inicio de sesi\u00f3n en \u2019isValidURL\u2019, y un indicador de configuraci\u00f3n opcional \u2019--block-remote-css-and-fonts\u2019 - pero no a\u00f1adi\u00f3 el marcador de filtrado de IP que el mismo c\u00f3digo base ya utiliza en los dos puntos finales SSRF hermanos (el gestor de proxy y la verificaci\u00f3n de enlaces). Antes de la versi\u00f3n 1.30.0, \u2019internal/htmlcheck/css.go::newSafeHTTPClient\u2019 est\u00e1 mal nombrado - construye un \u2019http.Client\u2019 cuyo \u2019Transport.DialContext\u2019 llama a \u2019net.Dialer.DialContext\u2019 directamente sin lista blanca de IP. Como resultado, la SSRF originalmente reportada por Bao Anh Phan todav\u00eda permite al servidor marcar rangos de loopback, privados, de enlace local y cualquier otro rango reservado/multicast, siempre que el objetivo responda con \u2019HTTP/200\u2019 y un tipo de contenido que comience con \u2019text/css\u2019. Con el seguimiento de redirecciones (\u2019CheckRedirect\u2019 permite redirecciones a cualquier URL \u2019isValidURL\u2019 sin filtro de IP), un sitio p\u00fablico controlado por el atacante puede redirigir la petici\u00f3n de mailpit a la red privada sin aparecer nunca en el HTML del correo electr\u00f3nico. En el despliegue predeterminado de mailpit (sin autenticaci\u00f3n de UI, sin autenticaci\u00f3n SMTP, puerto 1025/8025 expuesto), esta es una SSRF no autenticada y accesible por red, activada al enviar un correo electr\u00f3nico HTML y luego emitiendo una petici\u00f3n HTTP \u2019GET\u2019 a \u2019/api/v1/message/{id}/html-check\u2019. La versi\u00f3n 1.30.0 contiene una correcci\u00f3n actualizada."}], "id": "CVE-2026-45709", "lastModified": "2026-10-24T20:10:00.137", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-45709", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-07-20T19:01:39.446033Z", "version": "2.0.3"}}]}, "published": "2026-07-20T16:17:00.190", "references": [{"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/axllent/mailpit/releases/tag/v1.30.0"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/axllent/mailpit/security/advisories/GHSA-j3fj-qppj-fmmc"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-918"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.28.3,1.30.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "mailpit", "source": "cna", "vendor": "axllent"}, "product": "mailpit", "vendor": "axllent"}], "created": "2026-07-20T22:45:17.214871+00:00", "updated": "2026-07-30T19:30:09.697757+00:00", "vendors": ["axllent", "axllent$PRODUCT$mailpit"]}