CVE-2026-114478
Received Received - Intake

Insufficient Sender Preservation in hMailServer

Publication date: 2026-10-21

Last updated on: 2026-10-21

Assigner: GitLab Inc.

Description
Insufficient preservation of the original sender in the forwarding of Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a remote unauthenticated attacker to have mail they write, naming in its From an address at a domain the server hosts, delivered to other receivers as passing that domain's DMARC policy. When the server sent on a copy of mail that came from outside - an account's forward, a mail rule's forward, a Sieve redirect, a list's copy, or an alias or list expanding to an outside address - it could give the copy an SMTP identity in the organisation of the domain the copy's From names, whatever the message's origin: with the Sender Rewriting Scheme or the rewrite of the envelope sender on forwarding enabled (both off by default), an address at the forwarding domain; for a list, its bounce address; for a message with an empty envelope sender, none, under the server's own host name; and an envelope sender the message came with at a subdomain of a hosted domain was kept. Where that identity's SPF record authorises the server, other receivers' SPF check of the copy passed for a domain aligned with the From, and DMARC passed with it, although the message had not passed DMARC when the server received it. Exploitation needs a forward, redirect, alias or list that carries the hosted domain's mail to an outside address, and one of: SRS or the envelope rewrite enabled; a list whose bounce address is in the domain's organisation; an envelope sender at a subdomain whose SPF record authorises the server; or, for an empty envelope sender, an SPF record that authorises the server under its host name. The DKIM route to the same result is CVE-2026-107567.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-21
Last Modified
2026-10-21
Generated
2026-10-21
AI Q&A
2026-10-21
EPSS Evaluated
N/A
NVD
CVE-2026-114478
EUVD
EUVD-2026-107321

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Progressive Robot Ltd hMailServer 6.0.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-441 The product receives a request, message, or directive from an upstream component, but the product does not sufficiently preserve the original source of the request before forwarding the request to an external actor that is outside of the product's control sphere. This causes the product to appear to be the source of the request, leading it to act as a proxy or other intermediary between the upstream component and the external actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in hMailServer versions 6.0.0 through 6.3.6 allows an attacker to bypass DMARC email authentication policies. When the server forwards or redirects emails from outside senders to external recipients, it can manipulate the envelope sender or host name to make the forwarded email appear as if it originated from a domain within the same organization. This causes SPF checks and DMARC alignment to pass, even though the original email did not meet DMARC requirements.

Detection Guidance

Check hMailServer logs for unusual forwarding or redirection events involving external domains. Review email headers of forwarded messages for mismatches between the original sender and the envelope sender. Use SPF/DMARC validation tools to inspect forwarded emails for policy bypass attempts.

Impact Analysis

An attacker could send an email with a forged 'From' address within a hosted domain. If the server forwards it externally under specific conditions, the recipient would see it as a legitimate email passing DMARC. This could lead to phishing or spoofing attacks, where malicious emails bypass security checks and appear trustworthy.

Compliance Impact

This vulnerability could undermine compliance with email security standards required by regulations like GDPR and HIPAA, which mandate protection against email spoofing and phishing. Bypassing DMARC checks may allow unauthorized access to sensitive data or facilitate fraudulent activities, increasing legal and reputational risks for organizations.

Mitigation Strategies

Upgrade hMailServer to version 6.3.7 or later. Disable SRS and envelope sender rewriting if not required. Review and restrict forwarding rules, aliases, and mailing lists to prevent external forwarding of emails from hosted domains. Adjust DMARC scoring thresholds to be more restrictive.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-114478. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart