CVE-2026-67448: Cross-Site WebSocket Hijacking via Path Normalization Discrepancy in Mailpit
Vulnerability ID: CVE-2026-67448
CVSS Score: 6.5
Published: 2026-08-20
A critical cross-site WebSocket hijacking (CSWSH) vulnerability in Mailpit allows malicious websites to bypass CORS security controls via URL-encoded path mismatches, exposing sensitive development SMTP communications to unauthorized actors.
TL;DR
A URL-encoding parsing difference between Mailpit's middleware and Go's multiplexer enables malicious third-party websites to bypass CORS and hijack internal WebSocket feeds, leaking captured developer emails.
⚠️ Exploit Status: POC
Technical Details
- CWE ID: CWE-177
- Attack Vector: Network (AV:N)
- CVSS v3.1 Score: 6.5
- Impact: High Confidentiality Disclosure
- Exploit Status: Proof of Concept Available
- KEV Status: Not Listed
Affected Systems
- Mailpit versions 1.29.0 through 1.30.5
-
Mailpit: >= 1.29.0, < 1.30.6 (Fixed in:
1.30.6)
Code Analysis
Commit: fbe5e00
Set allowed websocket origins from configuration and fix RequestURI path discrepancy
Exploit Details
- GitHub Security Advisory: Detailing the Cross-Site WebSocket Hijacking proof of concept using the URL encoding bypass.
Mitigation Strategies
- Upgrade Mailpit to version 1.30.6 or newer.
- Configure the application user interface with basic authentication to block unauthorized cross-origin requests.
- Restrict service interfaces to bind strictly to localhost (127.0.0.1).
Remediation Steps:
- Terminate all running vulnerable Mailpit server instances.
- Update deployment scripts, Docker images, and local installations to Mailpit version 1.30.6.
- Configure the startup parameter
--ui-auth-fileif public or multi-tenant hosting environments are in use. - Verify that the WebSocket connection fails with a 403 status code when accessing endpoints using percent-encoded characters.
References
Read the full report for CVE-2026-67448 on our website for more details including interactive diagrams and full exploit analysis.
Top comments (0)