Read the docs
TI-2026-69163 Aliases CVE-2026-33586GHSA-rpc3-43rh-hpm4

Authenticated SMTP sender address forgery in OVHcloud mail servers

Priority LOW 27CWE-1188Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
None · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-290.

Summary

OVHcloud mail servers let any authenticated user with a valid OVH email account manipulate both the SMTP envelope sender and the From field before sending. Because OVH's default SPF configuration commonly includes mx.ovh.com, forged messages pass SPF validation even though the impersonated domain owner never authorized them. An authenticated attacker with low privileges can send email that appears to come from any OVH-hosted domain, and the flaw is linked to CWE-290.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

Authenticated users are able to manipulate both the SMTP envelope “Envelope-from” and “From” fields when sending emails through OVH mail servers. Due to OVH's default SPF configuration, which commonly includes include:mx.ovh.com, any authenticated user with a valid OVH email account can send messages that appear to originate from any OVH-hosted domains using the default SPF record. Since the SPF policy explicitly authorizes OVH mail servers (mx.ovh.com) to send mail on behalf of these domains, forged messages successfully pass SPF validation despite not being authorized by the impersonated domain owner.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00139 3rd percentileScored 2026-11-07
Fix Fixed OVHcloud (OVHcloud): 2026-07-20

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
OVHcloudOVHcloudbefore 2026-07-202026-07-20Patch availableCNA
  • OVHcloud VendorOVHcloud Affected before 2026-07-20 Fixed in 2026-07-20 Patch available CNA

Remediation

OVHcloud fixed this on 2026-07-20. Versions before 2026-07-20 are affected.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA OVHcloud (OVHcloud) Fixed in 2026-07-20

Timeline

  1. 2026-10-07 Threatist record created from CVE-2026-33586
  2. 2026-10-07 Alias added: GHSA-rpc3-43rh-hpm4
  3. 2026-10-07 CISA SSVC decision points changed
  4. 2026-10-07 Priority changed: MEDIUM → LOW

References

Other 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences