Read the docs
TI-2026-58835 Aliases CVE-2026-85751

Mailu: Authentication bypass in header-based proxy authentication via spoofable `X-Forwarded-By` trust

Priority MEDIUM 50CWE-290Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-290.

Summary

Mailu is a mail server distributed as a set of Docker images. From Mailu 2.0 until 2024.06.55 and prior to Mailu helm-charts 2.7.3, deployments with PROXY_AUTH_WHITELIST configured but REAL_IP_HEADER unset trusted a client-controlled X-Forwarded-By header for header-based proxy authentication. The proxy_hide_header directive in the nginx template at core/nginx/conf/proxy.conf hid the header from upstream responses but did not overwrite the incoming request value in this configuration. An unauthenticated remote attacker could therefore spoof the trusted proxy identity and bypass authentication. This issue is fixed in Mailu 2024.06.55 and Mailu helm-charts 2.7.3.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00557 46th percentileScored 2026-11-07
Fix Fixed Mailu (Mailu): 2024.06.55helm-charts (Mailu): 2.7.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
MailuMailu2.0.0 to before 2024.06.552024.06.55Patch availableCNA
Mailuhelm-chartsbefore 2.7.32.7.3Patch availableCNA
  • Mailu VendorMailu Affected 2.0.0 to before 2024.06.55 Fixed in 2024.06.55 Patch available CNA
  • helm-charts VendorMailu Affected before 2.7.3 Fixed in 2.7.3 Patch available CNA

Remediation

  • Fix · CNA Mailu (Mailu) Fixed in 2024.06.55
  • Fix · CNA helm-charts (Mailu) Fixed in 2.7.3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-85751

References

Other 6

  • TI-2026-75367 Mailu lets domain managers enable spoofing on other hosted domains CVSS 4.0HIGH 8.2
  • TI-2020-04295 Unspecified vulnerability in the fetchmail script in Mailu CVSS 3.1HIGH 8.8
  • TI-2026-36418 Mailu missing authentication on PATCH /api/v1/token/<id>, which allows unauthenticated removal of IP restrictions CVSS 3.1HIGH 7.5
  • TI-2026-75366 Mailu domain managers can take over higher-privileged accounts CVSS 3.1HIGH 7.2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences