CVE-2026-45709
Received Received - Intake

SSRF in Mailpit via HTML Check API

Publication date: 2026-07-20

Last updated on: 2026-07-20

Assigner: GitHub, Inc.

Description
Mailpit is an email testing tool and API for developers. The fix for GHSA-6jxm-fv7w-rw5j (CVE-2026-23845, "Server-Side Request Forgery (SSRF) via HTML Check API"), shipped in mailpit `v1.28.3`, hardened `internal/htmlcheck/css.go::downloadCSSToBytes` with a 5MB size cap, a `text/css` content-type check, login-info stripping in `isValidURL`, and an opt-in `--block-remote-css-and-fonts` config flag — but did not add the IP-filtering dialer that the same codebase already uses on the two sister SSRF endpoints (the proxy handler and link-check). Prior to version 1.30.0, `internal/htmlcheck/css.go::newSafeHTTPClient` is mis-named — it builds an `http.Client` whose `Transport.DialContext` calls `net.Dialer.DialContext` directly with no IP allowlisting. As a result, the SSRF originally reported by Bao Anh Phan still permits the server to dial loopback, private, link-local, and any other reserved/multicast range, provided the target replies with `HTTP/200` and a content-type beginning with `text/css`. With redirect-following (`CheckRedirect` allows redirects to any `isValidURL` URL with no IP filter), an attacker-controlled public site can redirect mailpit's request into the private network without ever appearing in the email's HTML. In the default mailpit deploy (no UI auth, no SMTP auth, port 1025/8025 exposed), this is an unauthenticated, network-reachable SSRF triggered by sending an HTML email and then issuing one HTTP `GET` to `/api/v1/message/{id}/html-check`. Version 1.30.0 contains an updated fix.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-20
Last Modified
2026-07-20
Generated
2026-07-21
AI Q&A
2026-07-20
EPSS Evaluated
N/A
NVD
CVE-2026-45709
EUVD
EUVD-2026-45966

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
axllent mailpit 1.28.3
axllent mailpit 1.30.0
axllent mailpit From 1.28.3 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-45709 is a Server-Side Request Forgery (SSRF) vulnerability in Mailpit versions 1.28.3 and above. It stems from an incomplete fix for a previous SSRF issue (CVE-2026-23845). The vulnerability allows attackers to bypass restrictions and make Mailpit send requests to internal IP addresses by exploiting redirect-following in the HTML check API. Attackers can send an HTML email with a malicious CSS link, then trigger SSRF via the `/api/v1/message/{id}/html-check` endpoint.

Detection Guidance

To detect this SSRF vulnerability in Mailpit, monitor network traffic for outbound requests from Mailpit to internal IP ranges (loopback, private, link-local) triggered by the `/api/v1/message/{id}/html-check` endpoint. Check Mailpit logs for suspicious CSS download attempts or redirects to internal addresses. Use network tools like tcpdump or Wireshark to capture outbound connections from Mailpit's process.

Impact Analysis

This SSRF vulnerability can allow attackers to access internal services, perform port scanning via timing differences, or confirm cloud IMDS reachability through side channels. In default Mailpit deployments (no authentication, exposed ports), it is unauthenticated and network-reachable, making it exploitable by sending a single HTTP request after injecting a malicious email.

Compliance Impact

This SSRF vulnerability could lead to unauthorized access to internal systems, potentially exposing sensitive data. For GDPR, this may violate principles of data protection by design and default. For HIPAA, it could allow unauthorized access to protected health information if internal systems are compromised.

Mitigation Strategies

Upgrade Mailpit to version 1.30.0 or later immediately. If upgrading is not possible, restrict access to the `/api/v1/message/{id}/html-check` endpoint via network policies or authentication. Block outbound traffic from Mailpit to internal IP ranges at the firewall level. Disable the HTML check API if not required.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-45709. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart