CVE-2026-21859
📋 TL;DR
Mailpit versions 1.28.0 and below have a Server-Side Request Forgery (SSRF) vulnerability in the /proxy endpoint that allows attackers to make HTTP GET requests to internal network resources. Attackers can access internal services and APIs that should not be exposed. This affects all users running vulnerable versions of Mailpit.
💻 Affected Systems
- Mailpit
📦 What is this software?
Mailpit by Axllent
⚠️ Risk & Real-World Impact
Worst Case
Attackers could access sensitive internal APIs, retrieve credentials from metadata services, or pivot to attack other internal systems.
Likely Case
Information disclosure from internal services, reconnaissance of internal network structure, or accessing internal APIs with limited functionality.
If Mitigated
Limited impact if network segmentation prevents access to sensitive internal resources or if the proxy endpoint is not exposed.
🎯 Exploit Status
Exploitation requires sending HTTP requests to the /proxy endpoint with internal IP addresses. Limited to GET requests with minimal headers.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.28.1
Vendor Advisory: https://github.com/axllent/mailpit/security/advisories/GHSA-8v65-47jx-7mfr
Restart Required: Yes
Instructions:
1. Stop Mailpit service. 2. Update to version 1.28.1 using your package manager or by downloading from GitHub. 3. Restart Mailpit service.
🔧 Temporary Workarounds
Disable /proxy endpoint
allRemove or disable the /proxy endpoint if not needed.
Modify Mailpit configuration to disable proxy functionality
Network segmentation
allRestrict Mailpit's network access to prevent reaching internal resources.
Configure firewall rules to block Mailpit from accessing internal IP ranges
🧯 If You Can't Patch
- Implement strict network segmentation to isolate Mailpit from sensitive internal systems
- Deploy a web application firewall (WAF) with SSRF protection rules
🔍 How to Verify
Check if Vulnerable:
Check if Mailpit version is 1.28.0 or below and if the /proxy endpoint is accessible.Check Version:
mailpit --versionVerify Fix Applied:
Verify Mailpit version is 1.28.1 or higher and test that the /proxy endpoint blocks requests to internal IP addresses.📡 Detection & Monitoring
Log Indicators:
- Unusual requests to /proxy endpoint with internal IP addresses
- HTTP GET requests to internal resources from Mailpit
Network Indicators:
- Outbound connections from Mailpit to internal IP ranges on ports 80/443
SIEM Query:
source="mailpit" AND (url_path="/proxy" AND (dst_ip=10.0.0.0/8 OR dst_ip=172.16.0.0/12 OR dst_ip=192.168.0.0/16))