CVE-2026-67448

Executive Summary

CVE-2026-67448 affects Mailpit versions 1.29.0 through 1.30.6, an email testing tool and API used by developers. The vulnerability is a regression of an earlier WebSocket origin protection mechanism, allowing a malicious website to bypass Cross-Origin Resource Sharing (CORS) access controls and connect to an unauthenticated Mailpit instance's WebSocket endpoint. A successful attack results in unauthorized disclosure of sensitive email metadata including live message IDs, Message-Id values, sender and recipient fields, subjects, tags, and body snippets. The vulnerability requires user interaction (the victim must visit a malicious website) and carries a CVSS score of 6.5 (Medium-High severity) with high confidentiality impact. The issue is fixed in Mailpit version 1.30.6.

Technical Analysis

The root cause of CVE-2026-67448 lies in a normalization inconsistency between two distinct components of Mailpit's request handling pipeline: the origin-checking middleware and Go's HTTP routing mechanism (ServeMux).

The vulnerability mechanism can be decomposed as follows:

1. Middleware vs. Router Path Normalization Mismatch: The origin middleware located in server/server.go performs a prefix check against the raw, undecoded RequestURI field to determine whether the incoming request targets the /api/ path. Specifically, it checks for the literal string /api/ at the beginning of the request URI. However, Go's http.ServeMux router—which handles the actual request dispatch—uses the percent-decoded URL path for matching. This means a request to /%61pi/events (where %61 is the percent-encoded ASCII character a) is treated by the middleware as NOT starting with /api/ (because the raw URI string literally begins with /%61pi/), thereby circumventing the corsOriginAccessControl() protection. Simultaneously, the router decodes %61 to a, correctly matching the request to the /api/events WebSocket handler.

2. Disabled WebSocket Origin Validation: The WebSocket handler configuration in server/websockets/client.go sets websocket.Upgrader.CheckOrigin to return true unconditionally. This explicitly disables the WebSocket library's built-in origin validation, meaning any website (regardless of its origin domain) is permitted to establish a WebSocket connection. The library-level protection that would normally reject cross-origin WebSocket handshakes is entirely absent.

3. Authentication Gap: The default configuration of Mailpit (without --ui-auth-file protection) does not require any authentication. The API endpoints, including the WebSocket event stream, are accessible without credentials. The only barrier preventing arbitrary websites from reading the mail stream was the origin-checking middleware, which this vulnerability bypasses.

The attack chain relies on the classic "confused deputy" or DNS rebinding-adjacent scenario: a malicious webpage loaded in a victim's browser can issue a WebSocket connection request to a localhost or internal Mailpit instance. Because the CheckOrigin callback returns true for all origins and the middleware check is bypassed via percent-encoding, the browser-based attack succeeds.

It is important to note that this vulnerability specifically requires the victim to visit a malicious website while the Mailpit instance is running unauthenticated. Deployments using --ui-auth-file are not affected because authentication occurs at a layer not bypassed by this technique. The vulnerable code was introduced in version 1.29.0 and corrected in version 1.30.6.

Exploitation Scenarios

Step 1: Reconnaissance and Target Identification An attacker first identifies a target running Mailpit. Since Mailpit is a development tool typically bound to localhost or a development network interface, the attacker must identify a victim (developer or QA engineer) who has an active Mailpit instance running. This can be achieved through:

• Social engineering to lure the victim to a malicious website.
• Watering-hole attacks on developer forums or documentation sites.
• Phishing emails containing links to the attacker-controlled site.
• Passive network reconnaissance if Mailpit is exposed beyond localhost (e.g., bound to 0.0.0.0 on an internal network).

The attacker crafts a webpage designed to initiate a WebSocket connection to the victim's Mailpit instance. Since the byte-level pattern of the raw HTTP request must match the middleware check exactly, the attacker uses percent-encoding in the path.

Step 2: Triggering the Flaw When the victim navigates to the malicious website, the site's JavaScript executes a WebSocket connection attempt to ws://<target>/%61pi/events (or the equivalent HTTPS/WSS variant). The HTTP GET request's RequestURI is set to /%61pi/events. The corsOriginAccessControl() middleware inspects the raw URI, sees /%61pi/events (which does not start with the literal string /api/), and concludes the request is not an API call. It therefore skips the origin validation logic and allows the request to proceed to the next handler in the chain. Go's ServeMux then matches the request against its routing table using the decoded path /api/events, which corresponds to the live event WebSocket handler.

Step 3: WebSocket Connection Establishment and Data Exfiltration The WebSocket handler invokes websocket.Upgrader.CheckOrigin(req). Because this callback is hardcoded to return true, the Upgrader accepts the handshake regardless of the Origin header value. The connection is established, and the attacker's JavaScript receives a live stream of email event data. The data transmitted includes unique message identifiers, Message-Id headers, sender and recipient email addresses, subject lines, message tags, and email body snippets. This data flows continuously as new emails arrive in the Mailpit instance.

Step 4: Post-Exploitation Impact The attacker now has a live, real-time feed of the victim developer's test email traffic. Given that Mailpit is used for testing email functionality, the data may include password reset URLs, account activation links, OTP codes, verification tokens, or other sensitive content embedded in email bodies. The attacker can use this information to:

• Hijack test accounts on staging environments.
• Intercept one-time passwords for service accounts.
• Harvest credentials of test users.
• Gain insight into application architecture through email recipient patterns.
• Exfiltrate sensitive business data if test emails contain proprietary information.

No public PoC is available at the time of writing, but the attack chain is directly inferred from the vulnerability description. The technique of percent-encoding to bypass URI prefix checks is a well-documented class of web application filter bypass.

Impact Assessment

CVSS Analysis: The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N indicates a network-attackable vulnerability with low attack complexity, no privilege requirements, but mandatory user interaction. The scope is unchanged (single component), with high confidentiality impact and no integrity or availability impact. This aligns with the data-exfiltration-only nature of the flaw.

Business Impact: For organizations using Mailpit in development or QA pipelines, this vulnerability exposes sensitive email content to any third-party website the developer visits. The severity is elevated in environments where:

• Mailpit instances are bound to non-loopback interfaces.
• Test emails contain production-like data (PII, credentials, financial information).
• Mailpit is used for security testing (where payloads, tokens, and exploit details may be in emails).
• Multi-developer teams share a Mailpit instance on a network.

Blast Radius: The attack is limited to the Mailpit instance and the data contained within it. However, the downstream impact of intercepted authentication tokens, password resets, and OTPs can extend to any system those emails reference. The attack does not compromise the Mailpit host itself, limiting the blast radius to data confidentiality rather than system integrity.

Affected Systems: All Mailpit deployments running versions 1.29.0 through 1.30.6 without --ui-auth-file protection. Instances protected by --ui-auth-file are explicitly unaffected per the vendor's advisory.

Detection Guidance

Detection of this vulnerability requires monitoring for anomalous WebSocket connections to Mailpit instances and for percent-encoded path traversal attempts.

Sigma Rule

title: Mailpit WebSocket Origin Bypass via Percent-Encoded Path
id: 3b1f2c4d-8e5a-4f6b-9c7d-1a2b3c4d5e6f
status: experimental
description: Detects attempts to connect to Mailpit WebSocket API using percent-encoded path to bypass origin checks
references:
    - "CVE-2026-67448"
tags:
    - attack.t1190
    - cve.2026.67448
    - cwe.177
logsource:
    category: webserver
    product: mailpit
detection:
    selection:
        http.uri|contains:
            - "/%61pi/events"
            - "/%61pi/"
    condition: selection
level: high
falsepositives:
    - Legitimate tooling that percent-encodes paths (rare)

YARA Rule

rule Mailpit_WebSocket_Origin_Bypass_CVE_2026_67448
{
    meta:
        author = "valtersit.com Threat Intelligence"
        description = "Detects HTTP requests exploiting percent-encoded path bypass in Mailpit WebSocket endpoint"
        cve = "CVE-2026-67448"
        date = "2026-01-01"
        severity = "high"
    strings:
        $http_get = "GET /" ascii wide
        $encoded_path1 = "%61pi/events" ascii wide
        $encoded_path2 = "%61pi" ascii wide
        $upgrade_header = "Upgrade: websocket" ascii wide nocase
    condition:
        filesize < 1MB and $http_get at 0 and $upgrade_header and 1 of ($encoded_path*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-67448 Mailpit WebSocket Origin Bypass Attempt"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/%61pi/events"; fast_pattern; sid:202667448; rev:1; reference:cve,2026-67448; classtype:attempted-information-leak;)

Elastic Detection

sequence by source.ip with maxspan=5m
  [ any where process.name : "mailpit" and http.request.path : "/%61pi/*" 
      and http.request.method : "GET" ]
  [ any where process.name : "mailpit" and http.request.headers : "Upgrade: websocket" ]

Splunk SPL Query

index=webserver sourcetype=access_combined
| where match(uri, "/%61pi/events")
| table _time, clientip, uri, status, useragent
| stats count by clientip, uri

Wazuh OSSEC Rule

<rule id="100487" level="12">
    <decoded>cve-2026-67448</decoded>
    <match>/%61pi/</match>
    <description>CVE-2026-67448 - Mailpit WebSocket origin bypass attempt via percent-encoded path</description>
    <group>webserver,exploit_attempt,cve_2026_67448,</group>
</rule>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED (no patch evidence from any tracked public source)

1. Immediate Mitigations:

   • Upgrade Mailpit to version 1.30.6 or later immediately. The vendor has confirmed this version fixes the issue.
   • If upgrade is not immediately possible, enable --ui-auth-file to require authentication for all API and WebSocket access. This completely mitigates the vulnerability per the vendor's advisory and does not rely on the flawed origin-check mechanism.
   • Bind Mailpit to localhost/127.0.0.1 only. Do not expose the service on network interfaces unless absolutely necessary. This limits the attack surface to local processes and browser-based attacks from the local machine.
   • Ensure firewall rules block external access to the Mailpit web port (default port 8025) and API port (default 1025).

2. Patch/Upgrade Steps:

   • Identify all Mailpit installations by scanning for the binary or checking process listings (ps aux | grep mailpit).
   • Download version 1.30.6 from the official Mailpit release channel (GitHub releases or package manager).
   • Replace the existing binary and restart the service. Verify the new version reports 1.30.6 on startup or via mailpit --version.
   • Validate that existing configuration files are compatible with the new version.

3. Long-Term Hardening:

   • Implement a Zero Trust access model for development tools. Mailpit and similar developer utilities should not be accessible from browsers on the general network.
   • Regularly audit email testing tools for exposed instances using Shodan-like search queries (product:Mailpit).
   • Educate developers on the risks of browsing untrusted websites while development tools are running.
   • Enable logging and monitoring on all Mailpit instances to capture WebSocket connection attempts and API access.
   • When deploying Mailpit, always require authentication (--ui-auth-file) even in local development environments.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-67448
2. Mailpit GitHub Repository / Releases: https://github.com/axllent/mailpit/releases (for version 1.30.6 fix)
3. CWE-177: Improper Handling of URL Encoding (Hex Encoding) — https://cwe.mitre.org/data/definitions/177.html
4. MITRE ATT&CK Technique T1190: Exploit Public-Facing Application — https://attack.mitre.org/techniques/T1190/

Known Threat Actor Campaigns / Exploit-in-the-Wild Evidence: No known campaigns or active exploitation have been reported at the time of this writing. The vulnerability is classified as having unknown exploit status. However, the attack vector is straightforward to implement and requires no specialized tooling beyond a web browser, making it a likely target for script-kiddie and opportunistic exploitation once public PoCs emerge. Organizations using Mailpit should prioritize patching given the low complexity and high data-disclosure potential.