Read the docs
TI-2024-16277 Aliases CVE-2024-24760

Mailcow Docker Container Exposure to Local Network

Priority MEDIUM 42CWE-610Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

mailcow is a dockerized email package, with multiple containers linked in one bridged network. A security vulnerability has been identified in mailcow affecting versions < 2024-01c. This vulnerability potentially allows attackers on the same subnet to connect to exposed ports of a Docker container, even when the port is bound to 127.0.0.1. The vulnerability has been addressed by implementing additional iptables/nftables rules. These rules drop packets for Docker containers on ports 3306, 6379, 8983, and 12345, where the input interface is not `br-mailcow` and the output interface is `br-mailcow`.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00868 58th percentileScored 2026-11-07
Fix Fixed mailcow-dockerized (mailcow): 2024-01c

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
mailcowmailcow-dockerizedbefore 2024-01c2024-01cPatch availableCNA
  • mailcow-dockerized Vendormailcow Affected before 2024-01c Fixed in 2024-01c Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:mailcow:mailcow\:_dockerized:*:*:*:*:*:*:*:*_dockerizedVulnerablemailcow
  • cpe:2.3:a:mailcow:mailcow\:_dockerized:*:*:*:*:*:*:*:* Versions _dockerized Vulnerable ·mailcow

Remediation

  • Fix · CNA mailcow-dockerized (mailcow) Fixed in 2024-01c

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-24760

References

Patch 1

Advisory 1

  • TI-2022-13182 OS Command Injection in mailcow CVSS 3.1HIGH 8.8
  • TI-2022-18634 mailcow-dockerized critical information misrepresentation can lead to phishing attacks through Swagger UI CVSS 3.1HIGH 8.2
  • TI-2024-15818 mailcow ipixel flood attack leads to Denial of Service in admin page CVSS 3.1MEDIUM 4.7
  • TI-2024-20015 mailcow Path Traversal and Arbitrary Code Execution Vulnerability CVSS 3.1MEDIUM 6.2
  • TI-2023-11637 mailcow is vulnerable to shell command injection via xoauth2 authentication in imapsync​ CVSS 3.1HIGH 8.8
  • TI-2022-13278 mailcow before 2022-05d allows a remote authenticated user to inject OS commands and… CVSS 3.1HIGH 8.8
See all 15 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences