CVE-2026-74998

Executive Summary

CVE-2026-74998 is a response-validation flaw in the CSS proxy component of Roundcube Webmail. Affected versions include all 1.6.x releases before 1.6.18 and 1.7.x releases before 1.7.3. An attacker can cause the browser to MIME-sniff a CSS proxy response as HTML, leading to information disclosure or cross-site scripting (XSS) in the context of the Roundcube webmail origin. The vulnerability is network-accessible, requires no privileges and no user interaction according to the CVSS vector, and is rated high severity with a CVSS score of 7.2.

Technical Analysis

Roundcube Webmail is a widely deployed open-source webmail client. The affected code area is the CSS proxy, a component that serves stylesheet-related responses to the user’s browser. According to the NVD description, responses returned by the CSS proxy were not validated. This lack of validation can be abused through MIME sniffing, a browser behavior in which content is interpreted based on its actual byte stream rather than the declared Content-Type header.

The vulnerability class is cross-site scripting (CWE-79). MIME sniffing enables an attacker to deliver a response that is declared to be CSS but contains HTML or JavaScript content. Modern browsers typically enforce X-Content-Type-Options: nosniff if the header is present; however, the description indicates the CSS proxy response path was not hardened against this behavior. If a browser sniffs a crafted CSS proxy response as text/html, embedded script can be executed in the Roundcube origin. Because the CSS proxy is part of the same webmail origin, the resulting XSS has access to the active session, cookies, mail content, and webmail functionality.

The exact attack surface, including the specific CSS proxy URL structure and request parameters, is not provided in the NVD description. No function names, file paths, or API endpoints are disclosed in the CVE record. The attack mechanism should therefore be assessed at the vulnerability-class level: insufficient validation of a web response allows a browser to reinterpret the response as HTML, enabling script execution.

The CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N. This indicates network exploitability, low attack complexity, no privilege requirement, and no user interaction requirement. The scope is changed, meaning the compromised component can affect resources beyond its security scope. Confidentiality and integrity impacts are low, but the combination of these factors produces an overall score of 7.2.

Exploitation Scenarios

No public proof-of-concept or exploit code for CVE-2026-74998 has been observed in the provided data. The attack chain is inferred from the vulnerability class and the NVD description.

1. Reconnaissance and target identification:
   An attacker identifies an internet-exposed Roundcube Webmail installation. This can be done with internet-wide scanning for webmail login portals, HTTP banner analysis, or known default Roundcube page titles. Authentication is not required before the vulnerable CSS proxy is reached.

2. Triggering the vulnerability:
   The attacker crafts an HTTP request that causes the Roundcube CSS proxy to return a response containing attacker-influenced content. Because the proxy responses are not validated, the returned content can include HTML or script fragments while being served with a CSS MIME type or with no restrictive MIME-handling header. The exact proxy invocation path is not specified in the public description, so the trigger is best described as a request to the CSS proxy designed to produce a to-be-sniffed response.

3. Payload and execution:
   When the victim’s browser loads the crafted CSS proxy response, MIME sniffing causes the browser to interpret the response as an HTML document. Any JavaScript embedded in the response executes in the Roundcube webmail origin. This may be delivered via a crafted link, a malicious email containing an image or iframe reference to the CSS proxy, or another vector that forces the browser to fetch the URL.

4. Post-exploitation impact:
   JavaScript execution in the webmail origin allows the attacker to steal session cookies, forge webmail requests, read email content, or perform actions on behalf of the victim. The scope change in the CVSS vector indicates that the impact can extend beyond the vulnerable component itself, potentially allowing the attacker to pivot to other parts of the webmail session or connected mail infrastructure.

Impact Assessment

Successful exploitation of CVE-2026-74998 results in XSS in the Roundcube Webmail origin. The business impact is significant for organizations whose users rely on webmail for sensitive communications. An attacker who achieves XSS can impersonate the victim, access mailbox contents, leak session tokens, and potentially use the webmail interface as a launch point for phishing or further lateral movement.

The CVSS subscores support a high-severity rating. The attack vector is network-based, requiring no authentication and no user interaction. The scope is changed, meaning that the XSS can affect data and resources outside the immediate application context. Confidentiality and integrity are both impacted, but at a low level; availability is not directly affected. Organizations should treat this as a priority because Roundcube Webmail is commonly exposed directly to the internet.

Detection Guidance

Sigma Rule

title: Potential Roundcube CSS Proxy MIME Sniffing XSS
id: 2f49a0e4-0001-4f6e-9c18-2a5f3f7b1234
status: experimental
description: Detects HTTP responses with a CSS MIME type whose body contains HTML or JavaScript markup, potentially matching CVE-2026-74998 MIME sniffing XSS.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-74998
logsource:
    category: webserver
    product: generic
detection:
    selection:
        http.response.content_type: text/css
        http.response.body|contains:
            - '<script'
            - '<html'
            - '<iframe'
            - 'javascript:'
    condition: selection
level: high

YARA Rule

rule Roundcube_CSS_Proxy_MIME_Sniffing_CVE_2026_74998
{
    meta:
        author = "Threat Intelligence"
        date = "2026-06-01"
        description = "Detects CSS proxy response content containing HTML/script markers indicative of MIME sniffing XSS payloads used against Roundcube Webmail."
        cve = "CVE-2026-74998"
    strings:
        $script = "<script" ascii nocase
        $html = "<html" ascii nocase
        $iframe = "<iframe" ascii nocase
        $js_event = "onerror=" ascii nocase
        $css_open = "/*" ascii
    condition:
        $css_open at 0 and (#script > 0 or #html > 0 or #iframe > 0 or #js_event > 0)
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"ET EXPLOIT Roundcube CSS Proxy MIME Sniffing XSS Attempt (CVE-2026-74998)"; flow:established,to_client; http.header; content:"Content-Type|3a| text/css"; file_data; content:"<script"; classtype:web-application-attack; reference:cve,2026-74998; reference:url,https://nvd.nist.gov/vuln/detail/CVE-2026-74998; sid:202674998; rev:1;)

This rule detects server responses that advertise a CSS content type while containing an HTML script tag. Such a response is a strong indicator of MIME-sniffing XSS content in the CSS proxy response stream.

Elastic Detection

sequence by source.ip, destination.ip, destination.port
  [ network where network.protocol == "http" and http.request.method == "GET" ]
  [ network where network.protocol == "http" and http.response.status_code == 200 and http.response.mime_type == "text/css" and http.response.body.content like "*<script*" ]

The EQL sequence identifies the initial request followed by a CSS response containing a script tag, which may indicate a CVE-2026-74998 exploitation attempt.

Splunk SPL Query

index=web sourcetype=stream:http http_content_type="text/css" http_response_body="*<script*"
| stats count by src_ip, dest_ip, url, http_response_code
| where count > 0

This query searches HTTP transaction logs for CSS responses that contain raw script content. SOC analysts should investigate the originating source IP and the target URL for further signs of malicious activity.

Wazuh OSSEC Rule

<group name="web_application_attack,">
  <rule id="100749" level="12">
    <if_sid>3150</if_sid>
    <match>text/css</match>
    <regex>\<script|onerror=|javascript:</regex>
    <description>Roundcube Webmail CSS proxy possible MIME sniffing XSS attempt (CVE-2026-74998)</description>
    <group>xss,web_application_attack,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

This Wazuh rule is designed to trigger on web server log entries where a CSS response contains JavaScript-like markers, indicating a possible MIME sniffing payload.

Mitigation & Patch Guidance

Patch confidence for CVE-2026-74998 is 0/4, meaning no patch evidence was found from tracked sources. The NVD description states that fixed versions are 1.6.18 and 1.7.3, but no vendor advisory was indexed in the provided data. Organizations should monitor the Roundcube project for official security announcements and apply updates as soon as they are verified.

1. Immediate mitigations:

   • Deploy a web application firewall or reverse proxy rule that inspects HTTP response bodies served with a CSS MIME type and blocks responses containing HTML, JavaScript, or event-handler attributes.
   • Enforce the X-Content-Type-Options: nosniff header at the reverse proxy layer for all responses originating from the Roundcube application. This prevents the browser from MIME-sniffing CSS proxy responses as HTML.
   • If the CSS proxy is not required for core webmail functionality, restrict or disable access to it through access-control rules.

2. Patch and upgrade steps:

   • Upgrade Roundcube Webmail to version 1.6.18 or 1.7.3 once the vendor releases or confirms these builds.
   • Test the upgrade in a staging environment before deploying to production.
   • Validate that the CSS proxy responses are properly served with a strict Content-Type and X-Content-Type-Options: nosniff after the upgrade.

3. Long-term hardening:

   • Place Roundcube Webmail behind a reverse proxy or Web Application Firewall with an allowlist for administrative access.
   • Use a Content Security Policy that restricts script sources and prevents execution of inline or unexpected script content.
   • Set webmail session cookies with HttpOnly, Secure, and SameSite attributes to reduce the impact of potential future XSS.
   • Enable multi-factor authentication for webmail accounts to limit the impact of session theft.
   • Monitor CISA KEV and vendor advisories for updates regarding active exploitation of CVE-2026-74998.

References

• NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-74998
• CVE.org Record: https://www.cve.org/CVERecord?id=CVE-2026-74998
• CWE-79 Cross-site Scripting: https://cwe.mitre.org/data/definitions/79.html
• Roundcube Webmail is not currently listed on the CISA Known Exploited Vulnerabilities catalog (CISA KEV: NO). No known threat actor campaigns or exploit-in-the-wild evidence were identified in the provided data.