PT-2026-33640 · Mailcow · Mailcow

Published 2026-04-19 · Updated 2026-04-27 · CVE-2026-40871

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions mailcow: dockerized versions prior to 2026-03b

Description A second-order SQL injection exists in the Mailcow API. The endpoint '/api/v1/add/mailbox' stores the quarantine category variable without proper validation or sanitization. This value is subsequently used by the quarantine notify.py function, which constructs SQL queries using unsafe string formatting instead of parameterized queries. This allows an attacker with API access to inject arbitrary SQL, which is executed when the quarantine notification job runs. This can lead to the exfiltration of sensitive data, such as admin credentials, which are then rendered inside quarantine notification emails.

Recommendations Update to version 2026-03b.

Exploit

Fix

SQL injection

Improper Encoding or Escaping of Output

RCE

Weakness Enumeration

CWE-89

CWE-116

CWE-564

CWE-20

Related Identifiers

CVE-2026-40871

Affected Products

Mailcow

References · 8

• 🔥 https://github.com/mailcow/mailcow-dockerized/security/advisories/GHSA-r8fq-wrfm-cj2q · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-40871 · Security Note
• https://reddit.com/r/cybersecurity/comments/1spvqrv/found_and_reported_a_secondorder_sql_injection_in · Reddit Post
• https://twitter.com/Dinosn/status/2045931087956705640 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2046740849082474616 · Twitter Post
• https://twitter.com/compuchris/status/2048563200627560615 · Twitter Post
• https://twitter.com/NullSecurityX/status/2046106705822380239 · Twitter Post
• https://twitter.com/N45HTOfficial/status/2046272482018263349 · Twitter Post