CVE-2026-85751
Received Received - Intake

Authentication Bypass in Mailu via X-Forwarded-By Header

Publication date: 2026-09-21

Last updated on: 2026-09-21

Assigner: GitHub, Inc.

Description
Mailu is a mail server distributed as a set of Docker images. From Mailu 2.0 until 2024.06.55 and prior to Mailu helm-charts 2.7.3, deployments with PROXY_AUTH_WHITELIST configured but REAL_IP_HEADER unset trusted a client-controlled X-Forwarded-By header for header-based proxy authentication. The proxy_hide_header directive in the nginx template at core/nginx/conf/proxy.conf hid the header from upstream responses but did not overwrite the incoming request value in this configuration. An unauthenticated remote attacker could therefore spoof the trusted proxy identity and bypass authentication. This issue is fixed in Mailu 2024.06.55 and Mailu helm-charts 2.7.3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-21
Last Modified
2026-09-21
Generated
2026-09-21
AI Q&A
2026-09-21
EPSS Evaluated
N/A
NVD
CVE-2026-85751
EUVD
EUVD-2026-83975

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
mailu mailu to 2024.06.55 (exc)
mailu helm-charts to 2.7.3 (exc)
mailu mailu to 2024.06.54 (inc)
mailu mailu 2024.06.55
mailu helm-charts 2.7.3

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-807 The product uses a protection mechanism that relies on the existence or values of an input, but the input can be modified by an untrusted actor in a way that bypasses the protection mechanism.
CWE-290 This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-85751 is an authentication bypass vulnerability in the Mailu email server software. It affects versions 2.0 through 2024.06.54 when PROXY_AUTH_WHITELIST is enabled but REAL_IP_HEADER is not set. The flaw allows an attacker to spoof the X-Forwarded-By header, bypassing authentication by impersonating a trusted proxy.

Detection Guidance

Check Mailu version with docker inspect or helm list to see if it is below 2024.06.55. Inspect nginx proxy configuration for missing REAL_IP_HEADER settings. Monitor logs for unusual X-Forwarded-By header values in requests.

Impact Analysis

An unauthenticated remote attacker could exploit this to bypass authentication controls, gain unauthorized access to email services, intercept or manipulate emails, and potentially escalate privileges. This could lead to data breaches, unauthorized data access, or service disruption.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements under GDPR and HIPAA. Organizations using affected Mailu versions may face compliance violations, legal penalties, and reputational damage due to potential data exposure.

Mitigation Strategies

Upgrade Mailu to version 2024.06.55 or later. Ensure REAL_IP_HEADER is properly configured in Mailu settings. Apply the nginx proxy configuration changes from PR #4070 or #4071.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-85751. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart