CVE-2026-67448

Received Received - Intake

Mailpit Origin Bypass via Percent-Encoded Path

Publication date: 2026-08-20

Last updated on: 2026-08-20

Assigner: GitHub, Inc.

Description

Mailpit is an email testing tool and API for developers. From 1.29.0 until 1.30.6, Mailpit's server/server.go origin middleware checks the raw RequestURI for the /api/ prefix while Go's ServeMux routes using the percent-decoded URL path, and server/websockets/client.go configures websocket.Upgrader.CheckOrigin to return true. A malicious website can request /%61pi/events, skip corsOriginAccessControl(), reach the /api/events WebSocket handler, and receive live message IDs, Message-Id values, sender and recipient fields, subjects, tags, and body snippets from an unauthenticated default Mailpit instance after the user visits the site. This is a regression of the earlier WebSocket origin protection and does not affect deployments protected by --ui-auth-file. This issue is fixed in version 1.30.6.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-20

Last Modified

2026-08-20

Generated

2026-08-21

AI Q&A

2026-08-21

EPSS Evaluated

N/A

NVD

CVE-2026-67448

Affected Vendors & Products

Vendor	Product	Version / Range
mailpit	mailpit	to 1.30.6 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-177	The product does not properly handle when all or part of an input has been URL encoded.
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CWE-346	The product does not properly verify that the source of data or communication is valid.

Attack-Flow Graph

Executive Summary

Mailpit is an email testing tool. From versions 1.29.0 to 1.30.6, it had a security flaw where the server incorrectly checked URL paths for API access. A malicious website could bypass CORS protections by using a percent-encoded URL like /%61pi/events to access the /api/events WebSocket handler. This allowed unauthorized access to live message data including IDs, sender/recipient details, subjects, and body snippets from an unauthenticated Mailpit instance.

Detection Guidance

Check Mailpit version with 'mailpit --version'. If it is between 1.29.0 and 1.30.6, the system is vulnerable. Monitor network traffic for requests to /%61pi/events or similar encoded paths.

Impact Analysis

If you run a vulnerable Mailpit instance (1.29.0 to 1.30.6), visiting a malicious website could expose your email data. Attackers could retrieve message IDs, sender/recipient information, subjects, and partial email bodies without authentication. This only affects default setups; instances protected by --ui-auth-file are not vulnerable.

Compliance Impact

This vulnerability could lead to unauthorized access and exposure of sensitive email data, violating GDPR's data protection principles and HIPAA's confidentiality requirements. Organizations using vulnerable Mailpit versions risk non-compliance due to potential data breaches and lack of proper access controls.

Mitigation Strategies

Upgrade Mailpit to version 1.30.6 or later. If upgrading is not possible, ensure deployments use the '--ui-auth-file' flag to enable authentication.

Hi! I’m here to help you understand CVE-2026-67448. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70