CVE-2026-42008
Received Received - Intake

Authentication Bypass via Trusted Proxy in Dovecot

Publication date: 2026-08-28

Last updated on: 2026-08-28

Assigner: Open-Xchange

Description
Forwarding information received from a host listed as a trusted proxy is not kept separate from Dovecot's own authentication fields, so a value sent by that host can be injected as an internal authentication field. Any host permitted to act as a trusted proxy can authenticate as any user without knowing that user's password. This affects deployments whose password database honours a field that permits authentication without a password. Deployments that do not configure trusted proxies are not affected. Restrict the list of trusted proxy networks to hosts that are fully under your control. Update to non-vulnerable version. No publicly available exploits are known.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-28
Last Modified
2026-08-28
Generated
2026-08-28
AI Q&A
2026-08-28
EPSS Evaluated
N/A
NVD
CVE-2026-42008
EUVD
EUVD-2026-67673

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
dovecot dovecot *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-287 When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Dovecot allows a trusted proxy to inject authentication fields that bypass password checks. Any host permitted as a trusted proxy can authenticate as any user without knowing the user's password if the password database allows authentication without a password.

Detection Guidance

Detecting this vulnerability requires checking Dovecot configurations for trusted proxy settings and authentication fields. Review Dovecot logs for unusual authentication attempts or proxy-related entries. Ensure trusted proxy networks are restricted to trusted hosts only.

Impact Analysis

An attacker controlling a trusted proxy could gain unauthorized access to user accounts without needing passwords. This could lead to data breaches, unauthorized email access, or further network compromise depending on the Dovecot deployment.

Compliance Impact

This vulnerability could violate compliance requirements for data protection and access control, such as GDPR's principle of least privilege or HIPAA's access control safeguards, by allowing unauthorized access to sensitive data.

Mitigation Strategies

Restrict trusted proxy networks to hosts fully under your control. Update Dovecot to a non-vulnerable version. Review and remove any configurations that allow passwordless authentication via trusted proxies.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-42008. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart