CVE-2026-33586 OVHcloud CVE debrief

Who should care

OVHcloud email users and administrators should assess exposure and review SPF configurations to prevent domain impersonation. They should also verify and update SPF configurations, monitor email logs for suspicious activity, and restrict email sending permissions for authenticated users. Additionally, they should confirm whether affected product deployments exist in managed environments and assign an owner for follow-up. It is essential to review the

Why it matters

Authenticated SMTP Sender Address Forgery in OVHcloud allows attackers to send emails appearing to originate from any OVH-hosted domains due to default SPF configuration. This issue affects OVHcloud users with valid email accounts, requiring review of SPF configurations and email sending permissions.

• Email domain impersonation possible for authenticated users
• SPF validation can be bypassed due to default configuration
• Email logs may require monitoring for suspicious activity
• Verification of affected versions and remediation steps is necessary

Technical summary

Authenticated users can manipulate SMTP envelope and 'From' fields, allowing them to send emails appearing to originate from any OVH-hosted domains due to OVH's default SPF configuration. The vulnerability is caused by the default SPF configuration, which authorizes OVH mail servers to send mail on behalf of OVH-hosted domains. This enables attackers to send forged emails that pass SPF validation. The issue affects OVHcloud users with valid email accounts, and it is essential to review SPF configurations and restrict email sending permissions to prevent

Defensive priority

Medium priority for OVHcloud email users and administrators to review SPF configurations and restrict email sending permissions.

Recommended defensive actions

• Review and restrict email sending permissions for authenticated users
• Verify and update SPF configurations to prevent domain impersonation
• Monitor email logs for suspicious activity
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and source item provide details on the vulnerability. However, specific versions affected and remediation steps require verification from OVHcloud. The issue is caused by OVH's default SPF configuration, which commonly includes include:mx.ovh.com. This allows any authenticated user with a valid OVH email account to send emails that appear to originate from any OVH-hosted domains. The default SPF record enables the forgery of sender addresses, potentially leading to phishing attacks or other malicious activities. To

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.