CVE-2026-114478 in hMailServer
Summary
by MITRE • 10/21/2026
Insufficient preservation of the original sender in the forwarding of Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a remote unauthenticated attacker to have mail they write, naming in its From an address at a domain the server hosts, delivered to other receivers as passing that domain's DMARC policy. When the server sent on a copy of mail that came from outside - an account's forward, a mail rule's forward, a Sieve redirect, a list's copy, or an alias or list expanding to an outside address - it could give the copy an SMTP identity in the organisation of the domain the copy's From names, whatever the message's origin: with the Sender Rewriting Scheme or the rewrite of the envelope sender on forwarding enabled (both off by default), an address at the forwarding domain; for a list, its bounce address; for a message with an empty envelope sender, none, under the server's own host name; and an envelope sender the message came with at a subdomain of a hosted domain was kept. Where that identity's SPF record authorises the server, other receivers' SPF check of the copy passed for a domain aligned with the From, and DMARC passed with it, although the message had not passed DMARC when the server received it. Exploitation needs a forward, redirect, alias or list that carries the hosted domain's mail to an outside address, and one of: SRS or the envelope rewrite enabled; a list whose bounce address is in the domain's organisation; an envelope sender at a subdomain whose SPF record authorises the server; or, for an empty envelope sender, an SPF record that authorises the server under its host name. The DKIM route to the same result is CVE-2026-107567.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/21/2026
The vulnerability identified in hMailServer versions 6.0.0 through 6.3.6 represents a critical failure in email authentication integrity, specifically concerning the preservation of the original sender identity during message forwarding operations. This flaw allows remote unauthenticated attackers to forge emails that appear to originate from domains hosted by the vulnerable server, thereby bypassing DMARC policies at receiving mail servers. The core technical issue lies in how the application handles envelope senders and SMTP identities when processing various types of email redirections, including account forwards, mail rule forwards, Sieve redirects, mailing list copies, and alias expansions directed to external recipients. Under normal security expectations, an intermediate server should not alter the authentication attributes of a message in a way that implies endorsement by its own domain unless explicitly configured for such behavior, yet this implementation fails to maintain strict alignment between the envelope sender and the header From address during these forwarding processes.
The operational mechanics of the exploit rely on specific configuration states within hMailServer. When features such as Sender Rewriting Scheme (SRS) or general envelope sender rewriting are enabled, which is off by default but often activated for compatibility with certain mailing list managers or bounce handling systems, the server may rewrite the SMTP envelope sender to an address belonging to the hosted domain rather than preserving the original external sender's identity. Similarly, if a message has an empty envelope sender, the server defaults to using its own hostname as the envelope sender. In cases involving mailing lists, the bounce address associated with the list is used as the envelope sender for forwarded copies. Additionally, if the incoming message carries an envelope sender from a subdomain of a hosted domain that authorizes the hMailServer in its SPF record, this identity is preserved and propagated to external recipients. These behaviors create a scenario where the receiving server sees an email with a From header pointing to a trusted domain and an envelope sender or authentication result that also aligns with that same trusted domain, even though the original message did not pass DMARC checks when it arrived at hMailServer.
The impact of this vulnerability is severe in terms of phishing and business email compromise risks. Because many receiving mail servers rely on SPF and DKIM results to determine whether an incoming message passes DMARC alignment, a successful exploit allows attackers to deliver malicious emails that appear legitimate to end-users and security filters alike. If the envelope sender or SRS-generated address falls under an SPF record that authorizes hMailServer's IP addresses, external receivers will validate the SPF check as passing for the domain specified in the From header. This results in DMARC compliance being falsely achieved, effectively bypassing anti-phishing protections designed to detect spoofed emails. Attackers can leverage this by crafting messages with a From address matching the target organization's domain and utilizing one of the aforementioned forwarding mechanisms within hMailServer to relay these messages externally while maintaining authentication validity.
Mitigation strategies must focus on both configuration hardening and architectural controls. Administrators should immediately review their hMailServer configurations to ensure that Sender Rewriting Scheme is disabled unless absolutely necessary for specific legacy integrations, and envelope sender rewriting should be turned off if it does not serve a critical operational purpose. For mailing lists, bounce addresses should be configured carefully to avoid using domain-internal addresses that could trigger SPF alignment issues when forwarding externally. Furthermore, organizations hosting mail on hMailServer should implement strict DMARC policies with p=reject or p=quarantine and ensure their SPF records do not inadvertently authorize the server for subdomains unless explicitly intended. Monitoring logs for unusual forwarding patterns to external domains can also help detect potential exploitation attempts. This vulnerability aligns with CWE-280, which covers improper handling of validation results, and maps to MITRE ATT&CK techniques related to email spoofing and bypassing security mechanisms through authentication manipulation.