CVE-2026-62643

Executive Summary

CVE-2026-62643 is a high-severity (CVSS 7.2) Server-Side Request Forgery (SSRF) and Information Disclosure vulnerability in Roundcube Webmail, affecting versions prior to 1.6.17 and 1.7.x prior to 1.7.2. The flaw stems from insufficient Cascading Style Sheets (CSS) sanitization in HTML email messages, allowing a malicious email to coerce the Roundcube server into making requests to internal network hosts via stylesheet links. Any organization running Roundcube Webmail as a public-facing email client is at risk, with potential exposure of internal network infrastructure, services, and sensitive information.

This vulnerability is a direct result of incomplete fixes for two predecessor CVEs (CVE-2026-35540 and CVE-2026-48843), indicating a persistent weakness in the CSS sanitization layer that attackers have actively probed. While no public exploit code exists and the CVE is not listed on CISA's Known Exploited Vulnerabilities catalog, the EPSS score of 0.00246 (16th percentile) suggests low immediate exploitation likelihood, though this should not diminish the urgency of patching given the straightforward nature of the attack vector.

Technical Analysis

The vulnerability resides in Roundcube Webmail's HTML email processing pipeline, specifically within the CSS sanitization engine. Roundcube parses HTML emails using a sanitizer designed to strip malicious content while preserving legitimate formatting. The flaw allows certain CSS constructs, particularly @import rules and url() declarations within style blocks, to reference external resources using protocols and hosts that should be blocked.

The core mechanism exploits Roundcube's CSS sanitizer, which fails to adequately validate URLs embedded in stylesheet directives. When a user opens a crafted HTML email, the following attack surface is exposed:

1. CSS @import Rule Handling: The sanitizer permits @import declarations that can point to arbitrary URLs, including internal IP addresses (e.g., http://192.168.1.1/), localhost (http://127.0.0.1/), or cloud metadata endpoints (http://169.254.169.254/).

2. URL Validation Bypass: The previous patches (CVE-2026-35540 and CVE-2026-48843) added blocklists for known dangerous hosts, but the incomplete fix fails to account for:

   • Alternate IP notation (decimal, octal, hex representations)
   • DNS rebinding techniques
   • Redirects that lead from an allowed external host to an internal one
   • Protocol-relative URLs (//internal-host/path)

3. Client-Side vs. Server-Side Execution: The critical distinction is that in many mail clients, CSS is applied client-side (in the browser). However, Roundcube's architecture processes certain email components server-side, particularly when generating previews, fetching remote content for sanitization, or resolving stylesheet links during rendering. This server-side processing is what enables SSRF.

4. Information Disclosure Vector: Even without full SSRF, the CSS sanitizer flaw permits exfiltration of sensitive data. An attacker can craft CSS selectors that reference internal resources, and timing measurements or error messages in the rendered output can reveal information about internal network topology, running services, and reachable ports.

The attack requires no authentication beyond having an email account on the target Roundcube instance. The email is delivered normally and triggers the flawed sanitization path upon message view or preview generation.

Exploitation Scenarios

Given the SSRF nature of this vulnerability, a malicious email can trigger server-side requests. A realistic attack chain is as follows:

Step 1 — Reconnaissance: The attacker identifies a Roundcube instance via Shodan or banner grabbing. They determine the version via the login page footer or specific HTTP headers. Confirming a vulnerable version (< 1.6.17 or 1.7.x < 1.7.2) validates the target.

Step 2 — Crafting the Malicious Email: The attacker composes an HTML email containing the following CSS payload:

<style>
  @import url("http://localhost:3306/");
  @import url("http://169.254.169.254/latest/meta-data/iam/security-credentials/");
  @import url("http://192.168.1.1/cgi-bin/");
</style>

To bypass residual filters, the attacker obfuscates the URLs:

@import url("http://2130706433:3306/");      <!-- 127.0.0.1 in decimal -->
@import url("http://0x7f000001/");            <!-- hex notation -->
@import url("//169.254.169.254/latest/meta-data/");

Step 3 — Delivery and Trigger: The email is sent to a victim mailbox on the target Roundcube server. When the victim either:

• Opens the email in the web interface
• Uses the preview pane (which renders HTML content)
• Or triggers Roundcube's remote content fetching during sanitization

...the CSS sanitizer processes the crafted stylesheet server-side.

Step 4 — SSRF Execution: The server-side CSS processing engine fetches the URLs specified in the @import rules. This causes Roundcube to issue HTTP requests to internal hosts and services from the server's network position. For cloud-hosted instances, the attacker can target the instance metadata service at 169.254.169.254 to harvest IAM temporary credentials.

Step 5 — Data Exfiltration: The response to the SSRF request is processed and potentially embedded in the rendered HTML or reflected in error messages. The attacker harvests:

• Internal service banners and headers
• Cloud metadata (IAM keys, instance details)
• Internal application data on unauthenticated endpoints
• Information about internal network topology (reachable IPs, open ports)

Step 6 — Post-Exploitation: Using harvested cloud credentials or discovered internal services, the attacker expands access into the internal network, pivoting from webmail compromise to broader network infiltration.

This attack succeeds with a single user interaction (opening an email) and requires no special privileges beyond a standard webmail account.

Impact Assessment

The CVSS 7.2 rating reflects High severity with a network attack vector, no authentication requirement (beyond email access), and user interaction required (opening the email). The scope is Changed, meaning the vulnerable component impacts resources beyond its security scope — SSRF reaches into the internal network.

Business Impact:

• Confidentiality (High): Internal network information, cloud credentials, and potentially sensitive data from internal services can be exfiltrated.
• Integrity (Low): The vulnerability primarily enables read operations; however, if internal services offer write endpoints without authentication, integrity could be compromised.
• Availability (Low): SSRF could be leveraged to send requests that crash internal services or consume resources, though this is not the primary objective.

Blast Radius:

• The Roundcube server itself
• All internal network hosts reachable from the Roundcube server
• Cloud metadata services (AWS, GCP, Azure) if the server runs in the cloud
• Internal databases, monitoring tools, and administrative interfaces on the internal network

Affected Deployments: Any organization running Roundcube Webmail. The package manager metadata indicates both 1.6.x and 1.7.x branches are affected, with fixes in 1.6.17 and 1.7.2 respectively. This spans a significant portion of the Roundcube user base, as many Linux distributions bundle Roundcube as their default webmail solution.

The parenthetical relationship to CVE-2026-35540 and CVE-2026-48843 suggests the attack technique is known and has been independently discovered or reported multiple times, raising the likelihood of future exploitation as the incomplete fixes become public knowledge alongside this CVE.

Detection Guidance

Sigma Rule

title: Roundcube Webmail CSS SSRF Exploitation Attempt
id: 3f7d9c2e-8b4a-4f6d-9e3c-1a2b4c5d6e7f
status: experimental
description: Detects HTTP requests to internal IP addresses from Roundcube webmail server, indicating potential CVE-2026-62643 exploitation.
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection_internal_ips:
        cs-host|endswith:
            - '.local'
            - '.internal'
            - '.localhost'
        cs-uri-query|contains:
            - '192.168.'
            - '10.0.'
            - '172.16.'
            - '127.0.0.1'
            - '169.254.169.254'
            - '0x7f000001'
            - '2130706433'
    selection_stylesheet:
        cs-uri-query|contains:
            - '.css'
            - '@import'
            - 'url('
    condition: selection_internal_ips and selection_stylesheet
level: high
falsepositives:
    - Legitimate internal stylesheet references in some configured templates
fields:
    - src_ip
    - dest_ip
    - cs-method
    - cs-uri-query
tags:
    - attack.t1190
    - cve.2026.62643
    - cwe.918

YARA Rule

rule Roundcube_CVE_2026_62643_SSRF_CSS
{
    meta:
        author = "Valtersite Threat Intelligence"
        description = "Detects malicious HTML email payloads exploiting CSS sanitization bypass for SSRF in Roundcube"
        date = "2026-01-15"
        cve = "CVE-2026-62643"
        severity = "high"
    strings:
        $css_import = "@import" ascii nocase
        $css_url = "url(" ascii nocase
        $internal_localhost = "localhost" ascii nocase
        $internal_loopback = "127.0.0.1" ascii nocase
        $internal_meta = "169.254.169.254" ascii nocase
        $internal_private = "192.168." ascii nocase
        $internal_private2 = "10." ascii nocase
        $internal_private3 = "172.16." ascii nocase
        $decimal_loopback = "2130706433" ascii
        $hex_loopback = "0x7f000001" ascii nocase
        $protocol_relative = "//" ascii
    condition:
        ($css_import or $css_url) and 
        (any of ($internal_*)) or ($decimal_loopback or $hex_loopback) or 
        ($protocol_relative and any of ($internal_*)) and filesize < 1MB
}

Suricata IDS Rule

alert http any any -> any any (msg:"ROUNDCUBE CVE-2026-62643 CSS SSRF Attempt"; flow:established,to_server; content:"@import"; http_uri; nocase; content:"url("; http_uri; nocase; pcre:"/(?:localhost|127\.0\.0\.1|169\.254\.169\.254|10\.\d{1,3}\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3}|172\.(?:1[6-9]|2[0-9]|3[0-1])\.\d{1,3}\.\d{1,3})/i"; reference:cve,2026-62643; classtype:attempted-admin; sid:1000626; rev:1;)

Elastic Detection

sequence by source.ip
  [network where event.type == "connection" and 
   process.name : "roundcube" and 
   destination.ip : ("10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16", "127.0.0.0/8", "169.254.169.254")]
  [file where event.type == "creation" and 
   file.extension == "css" and 
   file.path : "*roundcube*" and 
   process.name : "php*"]

Splunk SPL Query

index=* sourcetype=apache:access OR sourcetype=nginx:access
| search uri_query="*@import*" OR uri_query="*url(*"
| regex uri_query="(localhost|127\.0\.0\.1|169\.254\.169\.254|192\.168\.|10\.\d+\.\d+\.\d+|172\.(1[6-9]|2[0-9]|3[0-1])\.)"
| eval dest_internal = if(match(uri_query, "(localhost|127\.0\.0\.1|169\.254\.169\.254)"), "HIGH", "MEDIUM")
| stats count by dest_ip, src_ip, uri_query, dest_internal, _time
| sort - count
| where count > 1

Wazuh OSSEC Rule

<group name="roundcube,">
  <rule id="100626" level="12">
    <decoded_as>json</decoded_as>
    <field name="url">\.(?i)(@import|url\()</field>
    <match>localhost|127\.0\.0\.1|169\.254\.169\.254|192\.168\.|10\.\d+\.\d+\.\d+</match>
    <description>Roundcube CVE-2026-62643: CSS stylesheet referencing internal network resources</description>
    <group>attack.t1190,cwe.918,ssrf,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence is 3/4 (LIKELY) — two independent sources (OSV and Debian) confirm the fix. A patched version definitively exists.

1. Immediate Mitigations (until patched):

• Restrict outbound network access from the Roundcube server to only required external hosts (e.g., DNS, SMTP)
• Implement egress filtering to block connections to RFC 1918 addresses (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) and the metadata service IP 169.254.169.254 from the webmail server
• Disable remote content loading in Roundcube settings (both server-side disable_richtext_css and client-side "Show remote images" preference)
• Place the Roundcube server in a DMZ network segment isolated from internal services

2. Patch/Upgrade Steps:

• Upgrade Roundcube Webmail to version 1.6.17 or newer (1.6.x branch)
• Upgrade Roundcube Webmail to version 1.7.2 or newer (1.7.x branch)
• For Debian-based systems: apt update && apt upgrade roundcube
• For manual installations, download the patched version from https://roundcube.net/download
• Verify the upgrade by checking the version in the login page footer or via INSTALL file

3. Long-Term Hardening:

• Subscribe to Roundcube security advisories to receive timely CVE notifications
• Implement a regular patch management cycle for the webmail application
• Consider WAF rules to block CSS @import and url() references to internal IPs at the perimeter
• Enable Roundcube's built-in security features: enable_installer=false, verify_peer=true for SSL, and content security policies if supported
• Conduct periodic security audits of the webmail configuration and network segmentation

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-62643
2. OSV Advisory: https://osv.dev/vulnerability/CVE-2026-62643 (confirms fix in 1.6.17/1.7.2)
3. Debian Security Tracker: https://security-tracker.debian.org/tracker/CVE-2026-62643 (patch confirmation)
4. Roundcube Security Advisories: https://roundcube.net/news/security (vendor advisory page)
5. CWE-918 SSRF Reference: https://cwe.mitre.org/data/definitions/918.html

Threat Intelligence Notes: There is no evidence of active exploitation-in-the-wild for this CVE as of this report. No known threat actor campaigns reference this specific vulnerability. The CVE is not listed on CISA's Known Exploited Vulnerabilities catalog. However, the relationship to CVE-2026-35540 and CVE-2026-48843 indicates security researchers have repeatedly identified this weakness, and it may only be a matter of time before tooling incorporates this attack. The EPSS score of 0.00246 (16th percentile) suggests low current exploitation likelihood but does not predict future risk. SOC teams should monitor Roundcube installations for unusual outbound connections and internal IP references in HTTP logs.