TI-2026-65174 Aliases CVE-2026-101280 GHSA-fwhq-23fv-8x97

Trusted Domain Project OpenDMARC Multi-Record Set opendmarc_policy_query_dmarc authentication spoofing

HIGH 70CWE-287Published 2026-09-29 · Updated 2026-09-29

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Security bypass
Confidentiality · integrity · availability: Low · Low · Low
Fix status: No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-287.

Summary

A vulnerability was detected in Trusted Domain Project OpenDMARC up to 1.4.2. Affected is the function opendmarc_policy_query_dmarc of the component Multi-Record Set Handler. The manipulation results in authentication bypass by spoofing. The attack can be executed remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00403 34th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by the CNA

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Trusted Domain Project	OpenDMARC	1.4.0; 1.4.1; 1.4.2	—	No fix listed	CNA

OpenDMARC VendorTrusted Domain Project Affected 1.4.0; 1.4.1; 1.4.2 Fixed in — No fix listed CNA

CPE names CNA · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:trusted_domain_project:opendmarc::::::::	—	—	Trusted Domain Project

cpe:2.3:a:trusted_domain_project:opendmarc:*:*:*:*:*:*:*:* Versions — — ·Trusted Domain Project

Remediation

No fixed version listed by the sources yet.

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product

Red Hat

Timeline

2026-10-02 Threatist record created from CVE-2026-101280
2026-10-03 Alias added: GHSA-fwhq-23fv-8x97

References

Exploit 1

https://xuyongzhe-vt.github.io/share/opendmarc-multi-record-downgrade.html

TI-2026-65175 Trusted Domain Project OpenDMARC SPF Macro opendmarc_spf.c opendmarc_sp2_find_mailfrom_domain improper authentication CVSS 4.0MEDIUM 6.9
TI-2026-65173 Trusted Domain Project OpenDMARC opendmarc_policy.c integer overflow CVSS 4.0MEDIUM 6.9
TI-2026-65171 Trusted Domain Project OpenDKIM Tag Tokenizer dkim.c dkim_process_set less trusted source CVSS 4.0MEDIUM 6.9
TI-2026-65064 Trusted Domain Project OpenDMARC opendmarc_policy.c strcasecmp exceptional condition CVSS 4.0MEDIUM 6.9
TI-2026-65063 Trusted Domain Project OpenDMARC opendmarc_policy.c opendmarc_policy_parse_dmarc exceptional condition CVSS 4.0MEDIUM 6.9
TI-2026-65062 Trusted Domain Project OpenDMARC policy.c improper validation of unsafe equivalence in input CVSS 4.0MEDIUM 6.9

See all 13 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences