PT-2026-33640 · Mailcow · Mailcow

CVE-2026-40871 · Published 2026-04-19 · Updated 2026-04-27

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions mailcow: dockerized versions prior to 2026-03b

Description A second-order SQL injection exists in the Mailcow API. The endpoint '/api/v1/add/mailbox' stores the quarantine category variable without proper validation or sanitization. This value is subsequently used by the quarantine notify.py function, which constructs SQL queries using unsafe string formatting instead of parameterized queries. This allows an attacker with API access to inject arbitrary SQL, which is executed when the quarantine notification job runs. This can lead to the exfiltration of sensitive data, such as admin credentials, which are then rendered inside quarantine notification emails.

Recommendations Update to version 2026-03b.

Exploit

Fix

RCE

Improper Encoding or Escaping of Output

SQL injection

Weakness Enumeration

CWE-20

CWE-116

CWE-564

CWE-89

Related Identifiers

CVE-2026-40871

GHSA-R8FQ-WRFM-CJ2Q

Affected Products

Mailcow

References · 10

• 🔥 https://github.com/mailcow/mailcow-dockerized/security/advisories/GHSA-r8fq-wrfm-cj2q · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40871.json · Exploit
• https://osv.dev/vulnerability/CVE-2026-40871 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-40871 · Security Note
• https://twitter.com/VulmonFeeds/status/2046740849082474616 · Twitter Post
• https://twitter.com/NullSecurityX/status/2046106705822380239 · Twitter Post
• https://twitter.com/Dinosn/status/2045931087956705640 · Twitter Post
• https://reddit.com/r/cybersecurity/comments/1spvqrv/found_and_reported_a_secondorder_sql_injection_in · Reddit Post
• https://twitter.com/N45HTOfficial/status/2046272482018263349 · Twitter Post
• https://twitter.com/compuchris/status/2048563200627560615 · Twitter Post