CVE-2026-85751

Received
Published: 21 Sept 2026, 15:39
Last modified:21 Sept 2026, 17:56

Vulnerability Summary

Overall Risk (default)
high
70/100
CVSS Score
9.8 CRITICAL
v3.1 (cve.org)
EPSS Score
No data
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

21 Sept 2026, 15:39
Published
Vulnerability first disclosed
21 Sept 2026, 17:56
Last Modified
Vulnerability information updated

Description

Mailu is a mail server distributed as a set of Docker images. From Mailu 2.0 until 2024.06.55 and prior to Mailu helm-charts 2.7.3, deployments with PROXY_AUTH_WHITELIST configured but REAL_IP_HEADER unset trusted a client-controlled X-Forwarded-By header for header-based proxy authentication. The proxy_hide_header directive in the nginx template at core/nginx/conf/proxy.conf hid the header from upstream responses but did not overwrite the incoming request value in this configuration. An unauthenticated remote attacker could therefore spoof the trusted proxy identity and bypass authentication. This issue is fixed in Mailu 2024.06.55 and Mailu helm-charts 2.7.3.

CVSS Metrics

  • v3.1•CRITICAL•Score: 9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Techniques & Countermeasures

  • CWE-290•Authentication Bypass by Spoofing

    This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.

  • CWE-807•Reliance on Untrusted Inputs in a Security Decision

    The product uses a protection mechanism that relies on the existence or values of an input, but the input can be modified by an untrusted actor in a way that bypasses the protection mechanism.

Affected Systems

  • mailu•helm-charts

    < 2.7.3

  • mailu•mailu

    ≥ 2.0.0, < 2024.06.55

References (6)