CVE-2026-114726 Roundcube CVE debrief

Who should care

Defenders responsible for Roundcube Webmail instances should assess exposure and apply patches or mitigations as available to prevent potential exploitation attempts and disruption of email services. This includes verifying Roundcube Webmail version, reviewing email handling and header processing configurations, and monitoring for potential exploitation attempts. Security teams and vulnerability management teams should prioritize verifying exposure and rem

Why it matters

CVE-2026-114726 is a medium-severity vulnerability in Roundcube Webmail that allows for mail header injection. Defenders responsible for Roundcube Webmail instances should assess exposure and apply patches or mitigations as available to prevent potential exploitation attempts and disruption of email services.

• Potential for email header injection
• Possible disruption of email services
• Need for verification of Roundcube Webmail version and patching
• Potential for exploitation attempts

Technical summary

The vulnerability exists in the Bounce (resend) action of Roundcube Webmail and is caused by the rcube_mime::decode_address_list() function not stripping control characters from decoded display names. This allows a received message with a From display-name containing CRLF sequences in an encoded word to inject arbitrary headers into the message emitted when the user bounces it. The issue affects Roundcube Webmail before versions 1.6.20 and 1.7.5, and defenders should assess exposure and apply patches or mitigations as available.

Defensive priority

Defenders should prioritize verifying exposure of Roundcube Webmail instances to this vulnerability and applying patches or mitigations as available.

Recommended defensive actions

• Verify Roundcube Webmail version and apply patches or mitigations as available
• Monitor for potential exploitation attempts
• Review email handling and header processing configurations
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its existence in Roundcube Webmail before versions 1.6.20 and 1.7.5, and the specific cause of the issue. Defenders should verify Roundcube Webmail version and review email handling and header processing configurations. The vulnerability allows for mail header injection via the From display-name in the Bounce (resend) action. Evidence is limited to public CVE details and NVD assessments.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.