CVE-2026-40871
Second-Order SQL Injection in Mailcow API Enables Data Exfiltration
Publication date: 2026-04-21
Last updated on: 2026-04-21
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| mailcow | mailcow_dockerized | to 2026-03b (exc) |
| mailcow | dockerized | to 2026-03b (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-89 | The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data. |
| CWE-20 | The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. |
| CWE-116 | The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved. |
| CWE-564 | Using Hibernate to execute a dynamic SQL statement built with user-controlled input can allow an attacker to modify the statement's meaning or to execute arbitrary SQL commands. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-40871 is a high-severity second-order SQL injection vulnerability in the Mailcow dockerized package, affecting versions prior to 2026-03b.
The vulnerability occurs because the Mailcow API endpoint /api/v1/add/mailbox accepts a parameter called quarantine_category, which is stored in the database without any validation or sanitization.
Later, a script called quarantine_notify.py constructs SQL queries dynamically using unsafe string formatting (% operator) instead of parameterized queries, which leads to execution of malicious SQL code stored earlier.
This delayed execution (second-order SQL injection) allows an attacker with API access to inject arbitrary SQL commands that can exfiltrate sensitive data such as administrator credentials by embedding them into quarantine notification emails.
How can this vulnerability impact me? :
This vulnerability can have severe impacts on confidentiality, integrity, and availability of the affected system.
- An attacker with API access can inject malicious SQL payloads that are executed later, allowing extraction of sensitive data including admin credentials.
- The attacker can gain unauthorized access to internal data and potentially escalate to full system compromise.
- Sensitive information can be exfiltrated and embedded inside quarantine notification emails, making detection harder.
- The vulnerability can be combined with other attacks, such as cross-site scripting (XSS), to steal API keys and further exploit the system.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection of this vulnerability involves checking for the presence of malicious payloads in the quarantine_category field stored via the Mailcow API and monitoring the execution of the quarantine notification job that processes this field.
Since the vulnerability is a second-order SQL injection triggered when quarantine_notify.py runs, detection can include:
- Reviewing API logs for suspicious or unexpected input values in the /api/v1/add/mailbox endpoint, especially in the quarantine_category parameter.
- Querying the Mailcow database directly to inspect the quarantine_category field for unusual or SQL injection payload patterns.
- Monitoring quarantine notification emails for unexpected content that may indicate exfiltration of sensitive data.
Suggested commands might include:
- Using SQL queries to search for suspicious patterns in the quarantine_category field, for example: SELECT quarantine_category FROM mailbox WHERE quarantine_category LIKE '%UNION%';
- Checking API access logs for unusual POST requests to /api/v1/add/mailbox containing suspicious payloads.
- Reviewing the output or logs of quarantine_notify.py execution for errors or unexpected SQL query behavior.
What immediate steps should I take to mitigate this vulnerability?
The primary immediate mitigation step is to upgrade Mailcow dockerized to version 2026-03b or later, where this vulnerability is fixed.
Additional immediate steps include:
- Restrict API access to trusted users only, as the vulnerability requires high privileges via API access.
- Monitor and sanitize inputs to the /api/v1/add/mailbox endpoint, especially the quarantine_category parameter, to prevent injection of malicious payloads.
- Temporarily disable or restrict the quarantine notification job (quarantine_notify.py) if possible, until the patch is applied.
- Review and audit existing mailbox entries for suspicious quarantine_category values and remove or sanitize them.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability allows an attacker to exfiltrate sensitive data such as administrator credentials by exploiting a second-order SQL injection in the Mailcow system. Such unauthorized access and data leakage can lead to violations of data protection regulations like GDPR and HIPAA, which mandate the confidentiality and integrity of personal and sensitive information.
Because the vulnerability impacts confidentiality, integrity, and availability with high severity, it poses a significant risk to compliance with standards that require secure handling of sensitive data, including protecting against unauthorized access and data breaches.