PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-45709 axllent CVE debrief

Mailpit is an email testing tool and API for developers. The fix for GHSA-6jxm-fv7w-rw5j (CVE-2026-23845, 'Server-Side Request Forgery (SSRF) via HTML Check API'), shipped in mailpit `v1.28.3`, hardened `internal/htmlcheck/css.go::downloadCSSToBytes` with a 5MB size cap, a `text/css` content-type check, login-info stripping in `isValidURL`, and an opt-in `--block-remote-css-and-fonts` config flag — but did not add the IP-filtering dialer that the same codebase already uses on the two sister SSRF endpoints (the proxy handler and link-check). Prior to version 1.30.0, `internal/htmlcheck/css.go::newSafeHTTPClient` is mis-named — it builds an `http.Client` whose `Transport.DialContext` calls `net.Dialer.DialContext` directly with no IP allowlisting. As a result, the SSRF originally reported by Bao Anh Phan still permits the server to dial loopback, private, link-local, and any other reserved/multicast range, provided the target replies with `HTTP/200` and a content-type beginning with `text/css`. With redirect-following (`CheckRedirect` allows redirects to any `isValidURL` URL with no IP filter), an attacker-controlled public site can redirect mailpit's request into the private network without ever appearing in the email's HTML. In the default mailpit deploy (no UI auth, no SMTP auth, port 1025/8025 exposed), this is an unauthenticated, network-reachable SSRF triggered by sending an HTML email and then issuing one HTTP `GET` to `/api/v1/message/{id}/html-check`. Version 1.30.0 contains an updated fix.

Vendor
axllent
Product
mailpit
CVSS
MEDIUM 5.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-20
Original CVE updated
2026-07-21
Advisory published
2026-07-20
Advisory updated
2026-07-21

Who should care

Users of Mailpit versions prior to 1.30.0 should be aware of this SSRF vulnerability and take steps to mitigate it. This vulnerability is particularly concerning for users with Mailpit exposed to the network, as it allows for unauthenticated SSRF attacks.

Technical summary

The vulnerability exists in the `internal/htmlcheck/css.go::newSafeHTTPClient` function, which builds an `http.Client` without proper IP filtering. This allows an attacker to send requests to loopback, private, link-local, and reserved/multicast ranges, potentially leading to SSRF attacks. The vulnerability can be triggered by sending an HTML email and then issuing an HTTP GET request to `/api/v1/message/{id}/html-check`.

Defensive priority

High

Recommended defensive actions

  • Update Mailpit to version 1.30.0 or later
  • Restrict access to Mailpit to only trusted networks
  • Implement additional security measures, such as authentication and IP filtering
  • Review compensating controls for exposed systems while remediation is scheduled and verified
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability was reported by Bao Anh Phan and fixed in Mailpit version 1.30.0. The fix includes an updated `newSafeHTTPClient` function with proper IP filtering. Evidence is limited to public statements and may not reflect the full scope of affected systems or potential impact. Defenders should verify Mailpit deployments, review network exposure, and assess potential SSRF risks.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-20T16:17:00.190Z and has not been modified since then.