CVE-2026-107567
Received Received - Intake

DKIM Forgery in hMailServer via Trusted Source

Publication date: 2026-10-19

Last updated on: 2026-10-19

Assigner: GitLab Inc.

Description
Use of a less trusted source in the DKIM signing of Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a remote unauthenticated attacker to have mail they write signed with the DKIM key of a domain the server hosts, so that it passes DKIM and DMARC for that domain at other receivers. With DKIM signing enabled for a hosted domain, the server signed every message on its first delivery pass as the domain named in its From header, before local delivery, whatever the message's origin and without checking that its sender had authenticated. A sender anywhere could therefore send the server, as ordinary inbound mail, a message whose From is any address at such a domain, and the server signed it with that domain's key. Every copy the server then sent on to an address outside carried a valid signature aligned with the forged From, whatever the domain's DMARC policy: an account's forward, a mail rule's forward or copy, a Sieve redirect, an alias or distribution list with an outside member, the mirror copy, a managed-list or journal copy, or a message released from quarantine. A signed copy can also be re-sent to other recipients while the domain's key is unchanged. Exploitation needs DKIM signing to be enabled for the hosted domain (it is off until configured) and, for the forgery to leave the server, a forward, alias, list or rule that carries the domain's mail to an outside address. The signer likewise signed a message submitted over authenticated SMTP as whatever hosted domain its From header named, a header authenticated SMTP does not hold to the submitting account, so that an account of one hosted domain could have mail written in the name of another hosted domain signed with that domain's key; this mattered where the server holds signed-in senders to their own envelope addresses (SmtpAuthenticatedSenderCheck, off by default), as the signature was then the remaining way for such mail to pass the other domain's DMARC policy.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-19
Last Modified
2026-10-19
Generated
2026-10-19
AI Q&A
2026-10-19
EPSS Evaluated
N/A
NVD
CVE-2026-107567
EUVD
EUVD-2026-104406

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Progressive Robot Ltd hMailServer 6.0.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-348 The product has two different sources of the same data or information, but it uses the source that has less support for verification, is less trusted, or is less resistant to attack.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in hMailServer 6.0.0 through 6.3.6 allows a remote unauthenticated attacker to forge emails that appear to come from a hosted domain on the server. The server signs outgoing messages with the DKIM key of the domain in the From header, even if the sender is not authenticated. This lets attackers bypass DKIM and DMARC checks, making the forged emails seem legitimate.

Detection Guidance

To detect this vulnerability, check if hMailServer versions 6.0.0 through 6.3.6 are running and if DKIM signing is enabled for hosted domains. Review mail logs for suspicious outgoing messages with forged From headers. Use commands like 'hmailserver -v' to check version and 'grep DKIM /path/to/hmailserver.ini' to verify DKIM settings.

Impact Analysis

Attackers can impersonate users within your domain to send phishing emails or spread malware. These emails will pass DKIM and DMARC validation, tricking recipients into trusting them. This could damage your domain's reputation and lead to security breaches or financial losses.

Compliance Impact

This vulnerability could violate compliance requirements that mandate email authenticity and security, such as GDPR's data protection principles or HIPAA's integrity controls. Forged emails may lead to unauthorized data access or disclosure, triggering regulatory penalties or legal consequences.

Mitigation Strategies

Upgrade hMailServer to version 6.3.7 or later. If upgrading is not possible, disable DKIM signing for hosted domains, enable DMARC checks with high failure scores, or use event scripts to reject unauthenticated messages from hosted domains. Rotate DKIM keys to invalidate existing forged signatures.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-107567. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart