CVE-2026-67448 axllent CVE debrief

Who should care

Mailpit users and administrators should be aware of this vulnerability and take steps to update their instances to version 1.30.6 or later. This includes reviewing and restricting WebSocket connections to trusted origins and monitoring for unauthorized access to Mailpit instances. Security teams should prioritize updating to the latest version and review compensating controls for exposed systems while remediation is scheduled and verified.

Technical summary

A vulnerability in Mailpit's WebSocket implementation allows an attacker to bypass origin checks and access sensitive information. The issue affects Mailpit versions from 1.29.0 to 1.30.5 and is fixed in version 1.30.6. The vulnerability arises from the difference in how the raw RequestURI and percent-decoded URL path are handled by the server/server.go origin middleware and Go's ServeMux routes, respectively. Additionally, server/websockets/client.go configures websocket.Upgrader.CheckOrigin to return true, which does not provide sufficient protection. An unauthenticated attacker can exploit this by requesting /%61pi/events, skipping corsOriginAccessControl(), and reaching the /api/events WebSocket handler to receive live message IDs, Message-Id values, sender and recipient fields, subjects, tags, and body snippets.

Defensive priority

Mailpit users should prioritize updating to version 1.30.6 to address the WebSocket origin bypass vulnerability.

Recommended defensive actions

• Update Mailpit to version 1.30.6 or later
• Review and restrict WebSocket connections to trusted origins
• Monitor for unauthorized access to Mailpit instances
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, which affects Mailpit versions from 1.29.0 to 1.30.5. Evidence is based on official records and vendor advisories. The vulnerability allows an attacker to bypass origin checks and access sensitive information through the WebSocket handler. This issue is a regression of earlier WebSocket origin protection. Mailpit users should verify their instances and update to version 1.30.6 or later. The CVE record was published on 2026-08-20T22:17:56.870Z and has not been modified since then. No additional information is available on exploit activity or campaigns using this vulnerability.

Official resources