CVE-2026-75006

VENDOR_NAME: Roundcube AFFECTED_VERSION: < 1.6.18, 1.7.0 - 1.7.2 MITRE_TACTIC: T1190 — Exploit Public-Facing Application SHODAN_DORKS: ["title:"Roundcube Webmail"", "http.html:"Roundcube Webmail""] CWE_ID: CWE-918 CVSS_VECTOR: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N POC_STATUS: None PATCH_DETAILS: Roundcube Webmail 1.6.18, 1.7.3

Executive Summary

CVE-2026-75006 is a Server-Side Request Forgery (SSRF) and Information Disclosure vulnerability in Roundcube Webmail affecting versions prior to 1.6.18 and 1.7.x prior to 1.7.3. The vulnerability stems from insufficient Cascading Style Sheets (CSS) sanitization when processing HTML-formatted email messages, allowing external stylesheet references to point to internal or local network hosts. Successful exploitation enables unauthenticated attackers to leverage the webmail instance to perform network reconnaissance, issue HTTP requests to internal services, or expose restricted environment details.

Technical Analysis

Roundcube Webmail incorporates an HTML rendering engine designed to parse and sanitize incoming HTML emails before displaying them in the user interface. Part of this sanitization workflow involves filtering inline styles, embedded <style> elements, and external <link rel="stylesheet"> tags to prevent cross-site scripting (XSS), data exfiltration, and unauthorized network fetches.

Under CVE-2026-75006, the CSS sanitization mechanism fails to adequately inspect, filter, or restrict stylesheet links embedded within HTML email bodies. When processing specialized CSS syntax or link references that target internal local network hosts (such as http://127.0.0.1, http://169.254.169.254, or internal RFC 1918 IP addresses), the filtering logic permits these URIs to pass through unmanaged or fail to enforce proper network boundary restrictions.

This flaw is identified as a incomplete fix for previous vulnerabilities in the same sanitization module (specifically CVE-2026-35540, CVE-2026-48843, and CVE-2026-62643). Due to residual edge cases in the CSS parser logic, malicious structural variations in CSS links bypass the established blocklists or URI validation checks. Depending on how the client browser or server environment renders or pre-fetches the stylesheet resources, the application triggers unwanted HTTP requests toward internal network infrastructure, classifying the issue under CWE-918 (Server-Side Request Forgery).

Exploitation Scenarios

No public Proof-of-Concept (PoC) exploit is currently available for CVE-2026-75006. The following attack sequence represents the expected exploitation lifecycle based on the vulnerability class and documented characteristics.

1. Reconnaissance & Target Identification: The attacker identifies target organizations running exposed Roundcube Webmail instances using search engines such as Shodan or by analyzing HTTP response headers.
2. Payload Crafting: The attacker constructs an HTML-formatted email containing embedded CSS elements (such as stylesheet <link> tags or CSS import statements) that specify URIs pointing to targeted internal endpoints, such as local service ports (http://127.0.0.1:8080) or cloud service metadata instances (http://169.254.169.254).
3. Delivery & Execution: The malicious email is sent to a recipient on the targeted Roundcube server. When the webmail client or application server processes the HTML body, the CSS sanitization routine fails to neutralize the local network links.
4. Post-Exploitation: The request is issued to the targeted local host or internal network node. The attacker observes side-channel timing differences, resource load states, or inbound network connections to confirm internal host presence, map internal services, or achieve information disclosure.

Impact Assessment

The business impact of CVE-2026-75006 centers on unauthorized exposure of internal network topologies and potential compromise of internal-only endpoints.

• Confidentiality Impact: Indirect. SSRF allows attackers to scan internal infrastructure, detect open management ports, and potentially query sensitive local APIs (e.g., cloud metadata endpoints or local administrative interfaces) that trust traffic originating from localhost or internal subnets.
• Integrity Impact: Low (CVSS Integrity subscore: Low). Attackers can trigger unauthorized request states or inter-service interactions via HTTP GET/HEAD requests sent to internal network devices.
• Availability Impact: Minimal to None (CVSS Availability: None). Direct service disruption is not expected, though backend internal services targeted by excessive SSRF requests may experience secondary performance degradation.
• CVSS Metrics: 5.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N). The Scope is set to Changed (S:C) because the vulnerability allows requests to bridge the boundary between the external webmail interface and isolated internal network segments.

Detection Guidance

Sigma Rule

title: Roundcube HTML Email CSS SSRF Attempt
id: 5e82b7c4-2a1d-4091-a20d-8fb2f7689240
status: experimental
description: Detects incoming webmail requests or proxy traffic indicating CSS stylesheet links targeting loopback or local private IP ranges in Roundcube Webmail contexts.
author: Security Operations Center
date: 2026/03/30
logsource:
  category: webserver
  product: apache
detection:
  selection_roundcube:
    cs_uri_stem|contains:
      - '/roundcube/'
      - '/webmail/'
      - '/?_task=mail'
  selection_ssrf_payload:
    cs_uri_query|contains:
      - '127.0.0.1'
      - 'localhost'
      - '169.254.169.254'
      - '10.'
      - '192.168.'
      - '172.16.'
  condition: selection_roundcube and selection_ssrf_payload
falsepositives:
  - Legitimate internal integration plugins passing local references.
level: medium
tags:
  - attack.initial_access
  - attack.t1190
  - cwe.918

YARA Rule

rule Roundcube_CSS_Sanitization_Bypass_SSRF {
    meta:
        description = "Detects HTML email content attempting to trigger CSS-based SSRF against local network resources"
        author = "Threat Intelligence Team"
        date = "2026-03-30"
        cve = "CVE-2026-75006"
        cwe = "CWE-918"
    strings:
        $html_tag = "<html" ascii case_insensitive
        $css_link = "rel=\"stylesheet\"" ascii case_insensitive
        $css_import = "@import" ascii case_insensitive
        
        $target_loopback = "http://127.0.0.1" ascii case_insensitive
        $target_localhost = "http://localhost" ascii case_insensitive
        $target_metadata = "http://169.254.169.254" ascii case_insensitive
        $target_priv_10 = "http://10." ascii case_insensitive
        $target_priv_192 = "http://192.168." ascii case_insensitive
        $target_priv_172 = "http://172." ascii case_insensitive
    condition:
        $html_tag and ($css_link or $css_import) and 1 of ($target_*)
}

Suricata IDS Rule

alert http $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"EXPLOIT-KIT Roundcube Webmail HTML Email CSS SSRF Attempt (CVE-2026-75006)"; flow:to_server,established; content:"POST"; http_method; content:"_task=mail"; http_uri; content:"127.0.0.1"; http_client_body; fast_pattern; reference:cve,2026-75006; classtype:web-application-attack; sid:20267500; rev:1;)

Elastic Detection

sequence by host.id with maxspan=5m
  [network where event.type == "start" and process.name in ("php-fpm", "apache2", "httpd", "nginx") and
   destination.ip in ("127.0.0.0/8", "10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16", "169.254.169.254")]
  [http where event.category == "web" and http.request.body.content : "*stylesheet*" or http.request.body.content : "*@import*"]

Splunk SPL Query

index=webmail_logs OR index=proxy OR index=web
(sourcetype="access_combined" OR sourcetype="stream:http")
("roundcube" OR "_task=mail")
("127.0.0.1" OR "localhost" OR "169.254.169.254" OR "10.0.0.0" OR "192.168.")
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, uri_path, uri_query, status, user_agent
| where count > 0
| eval duration=last_seen-first_seen

Wazuh OSSEC Rule

<group name="web,roundcube,ssrf,">
  <rule id="100950" level="8">
    <if_sid>31100</if_sid>
    <match>roundcube|webmail</match>
    <regex>127\.0\.0\.1|localhost|169\.254\.169\.254|10\.\d+\.\d+\.\d+|192\.168\.\d+\.\d+</regex>
    <description>Possible Roundcube CSS Sanitization Bypass / SSRF Attempt (CVE-2026-75006)</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>attack.initial_access,cwe_918,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 4/4 (CONFIRMED — Verified by NVD, OSV, Debian).

1. Immediate Mitigations

• Enforce network egress restrictions on Roundcube web application servers to block outbound HTTP/HTTPS requests to internal private subnets (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 127.0.0.0/8, and 169.254.169.254).
• Implement or update Web Application Firewall (WAF) rules to inspect incoming email body structures and drop requests containing external CSS link references targeting local IP structures.

2. Patch & Upgrade Steps

• For deployment branches on the 1.6.x release stream: Upgrade Roundcube Webmail to 1.6.18 or later.
• For deployment branches on the 1.7.x release stream: Upgrade Roundcube Webmail to 1.7.3 or later.
• Verify package integrity following distribution updates (e.g., via APT/YUM on Debian/Ubuntu/RHEL operating systems).

3. Long-Term Hardening

• Implement a Content Security Policy (CSP) header restricting the sources from which stylesheets (style-src / style-src-elem) can be loaded by client browsers rendering webmail output.
• Isolate the webmail processing environment into a dedicated container or segment with strict network namespace isolation.

References

1. NVD Record: https://nvd.nist.gov/vuln/detail/CVE-2026-75006
2. Debian Security Tracker: https://security-tracker.debian.org/tracker/CVE-2026-75006
3. OSV Vulnerability Database: https://osv.dev/vulnerability/CVE-2026-75006
4. Roundcube Releases: https://roundcube.net/news/