CVE-2026-84697
Received Received - Intake

Mailpit Server-Side Request Forgery via Internal IP Bypass

Publication date: 2026-09-02

Last updated on: 2026-09-02

Assigner: VulnCheck

Description
Mailpit's IsInternalIP deny list function fails to block the Azure WireServer address 168.63.129.16 and the RFC 2765/6145 IPv4-translated IPv6 prefix, allowing server-side request forgery to internal destinations. Attackers can supply hostnames resolving to these addresses in message content to reach the link check API and proxy endpoint for accessing internal resources.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-02
Last Modified
2026-09-02
Generated
2026-09-02
AI Q&A
2026-09-02
EPSS Evaluated
N/A
NVD
CVE-2026-84697
EUVD
EUVD-2026-69788

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
axllent mailpit to 1.31.0 (inc)
axllent mailpit 1.31.0
axllent mailpit From 1.31.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Mailpit's IsInternalIP deny list function fails to block the Azure WireServer address 168.63.129.16 and the RFC 2765/6145 IPv4-translated IPv6 prefix. This allows server-side request forgery to internal destinations. Attackers can supply hostnames resolving to these addresses in message content to reach the link check API and proxy endpoint for accessing internal resources.

Detection Guidance

Check if Mailpit is running on your system and verify its version. If it is version 1.31.0 or earlier, it is vulnerable. Inspect network logs for requests to 168.63.129.16 or IPv4-translated IPv6 prefixes. Use commands like 'curl -v http://localhost:8025' to test the web interface and monitor for unexpected internal requests.

Impact Analysis

An attacker could exploit this to access internal resources via Mailpit's link check API or proxy endpoint. This could lead to unauthorized data exposure, internal service manipulation, or further network compromise depending on the exposed services.

Compliance Impact

This SSRF vulnerability could potentially expose internal resources, which may lead to unauthorized access to sensitive data. For GDPR, this could impact data protection obligations if personal data is accessed. For HIPAA, it might risk protected health information exposure if internal systems are compromised.

Mitigation Strategies

Upgrade Mailpit to version 1.31.0 or later to address the SSRF vulnerability. If upgrading is not possible, apply the patch from the commit a02821bf3424da9196e156c422370f4868a1dff2 to block the vulnerable IP ranges. Restrict network access to Mailpit's ports (8025, 1025) and monitor for suspicious activity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-84697. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart