PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-27851 Open-Xchange GmbH CVE debrief

CVE-2026-27851 is a HIGH severity vulnerability (CVSS 7.4) in Dovecot affecting versions prior to 2.4.4 and Dovecot Pro prior to 3.1.5. The flaw occurs when the `safe` filter is used with variable expansion, causing all subsequent pipelines on the same string to be incorrectly interpreted as safe. This improper handling enables unsafe data to be unescaped, which can facilitate SQL or LDAP injection attacks when exploited in authentication contexts. The vulnerability was published on 2026-05-12 and last modified on 2026-05-18. No publicly available exploits are known at this time.

Vendor
Open-Xchange GmbH
Product
OX Dovecot Pro
CVSS
HIGH 7.4
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-12
Original CVE updated
2026-07-15
Advisory published
2026-05-12
Advisory updated
2026-07-15

Who should care

Organizations running Dovecot mail servers, particularly those using SQL or LDAP backends for authentication and user lookups. Security teams responsible for mail infrastructure, identity management administrators, and DevSecOps engineers maintaining Dovecot deployments should prioritize assessment and patching.

Technical summary

The vulnerability stems from improper propagation of the `safe` filter status during variable expansion in Dovecot's string processing. When `safe` is applied to a variable expansion, the implementation fails to properly reset the safety context for subsequent pipeline operations on the same string. This causes downstream filters to incorrectly treat potentially attacker-controlled data as safe, bypassing escaping mechanisms. In authentication contexts where Dovecot interacts with SQL databases or LDAP directories, this can result in injection attacks if user input reaches these backends through affected string processing paths.

Defensive priority

HIGH

Recommended defensive actions

  • Upgrade Dovecot to version 2.4.4 or later, or Dovecot Pro to version 3.1.5 or later
  • Until patched, avoid using the `safe` filter with variable expansion in Dovecot configurations
  • Review authentication-related configurations for potential SQL or LDAP injection vectors
  • Monitor authentication logs for anomalous patterns that may indicate injection attempts
  • Apply principle of least privilege to database and directory service connections used by Dovecot

Evidence notes

CVSS 3.1 vector: AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N. CWE-235 (Improper Handling of Extra Parameters) identified as secondary weakness. Affected product versions confirmed through CPE criteria in NVD data.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-27851 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-27851

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-27851 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-27851

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.