CVE-2026-86009
Deferred Deferred - Pending Action

Domain Spoofing in Mailu Docker Images

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: GitHub, Inc.

Description
Mailu is a mail server distributed as a set of Docker images. Prior to f05aeb8322e2f61096af6b089d61ba6f40587d96, domain managers can enable spoofing for hosted domains they do not control. A potentially malicious domain administrator enables spoofing for another hosted domain and can send emails that are authenticated with DKIM/SPF for domains they should not be able to. This vulnerability is addressed by f05aeb8322e2f61096af6b089d61ba6f40587d96.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-16
Last Modified
2026-10-16
Generated
2026-10-16
AI Q&A
2026-10-16
EPSS Evaluated
N/A
NVD
CVE-2026-86009
EUVD
EUVD-2026-102922

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Mailu Mailu < f05aeb8322e2f61096af6b089d61ba6f40587d96

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
CWE-285 The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-86009 is a vulnerability in Mailu, a mail server software, where domain managers can enable email spoofing for domains they do not control. This allows them to send emails that pass DKIM and SPF authentication checks for those domains, effectively impersonating other domains.

Detection Guidance

To detect this vulnerability, check if domain managers have enabled the 'allow-spoofing' permission for domains they do not control. Review Mailu's configuration files and database entries for the 'allow_spoofing' flag. Inspect email headers for DKIM/SPF authentication failures or unexpected domain spoofing attempts.

Impact Analysis

This vulnerability allows malicious or compromised domain administrators to send authenticated emails under false pretenses. It could lead to phishing attacks, fraud, or reputational damage if abused. Organizations using Mailu should update to patched versions to prevent exploitation.

Compliance Impact

This vulnerability allows domain managers to spoof emails from domains they do not control, which could lead to unauthorized data access or misrepresentation. For GDPR, this may violate principles of data integrity and confidentiality. HIPAA requires secure transmission of protected health information; spoofed emails could undermine trust in email authenticity.

Mitigation Strategies

Update Mailu to the patched version (commit f05aeb8322e2f61096af6b089d61ba6f40587d96 or later) to scope the 'allow_spoofing' flag to the sender's domain. Remove any cross-domain 'allow-spoofing' permissions granted by domain managers. Monitor email logs for suspicious activity and restrict domain manager privileges to their managed domains.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-86009. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart