CVE-2026-67448 in Mailpit
Summary
by MITRE • 08/21/2026
Mailpit is an email testing tool and API for developers. From 1.29.0 until 1.30.6, Mailpit's server/server.go origin middleware checks the raw RequestURI for the /api/ prefix while Go's ServeMux routes using the percent-decoded URL path, and server/websockets/client.go configures websocket.Upgrader.CheckOrigin to return true. A malicious website can request /%61pi/events, skip corsOriginAccessControl(), reach the /api/events WebSocket handler, and receive live message IDs, Message-Id values, sender and recipient fields, subjects, tags, and body snippets from an unauthenticated default Mailpit instance after the user visits the site. This is a regression of the earlier WebSocket origin protection and does not affect deployments protected by --ui-auth-file. This issue is fixed in version 1.30.6.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/21/2026
The vulnerability identified in Mailpit versions ranging from 1.29.0 to 1.30.6 represents a critical authentication bypass stemming from an inconsistency between URL path handling mechanisms within the Go web server framework and custom middleware logic. This issue specifically impacts the WebSocket endpoint used for real-time message monitoring, which is central to the tool's utility as an email testing interface. The core technical flaw arises because the origin validation middleware in server/server.go performs its security check by inspecting the raw RequestURI string directly. However, Go’s standard ServeMux router processes incoming requests by first percent-decoding the URL path before matching it against registered routes. This discrepancy creates a predictable attack vector where an attacker can manipulate the request URI to bypass the origin validation layer while still being correctly routed to the intended WebSocket handler.
A malicious website can exploit this logic error by sending a crafted HTTP upgrade request containing a percent-encoded variant of the API prefix, such as /%61pi/events instead of the expected /api/events. The character %61 corresponds to the lowercase letter 'a'. When the browser or client sends this request, the server's middleware inspects the raw URI string and fails to recognize it as an attempt to access the protected /api/ namespace because the literal characters do not match the hardcoded check. Consequently, the CORS origin validation function is skipped entirely. Despite bypassing this security control, the Go ServeMux decodes the path during route matching, successfully identifying the request as targeting the WebSocket endpoint at /api/events. This allows the connection to be established without verifying that the Origin header matches the expected trusted domain.
The operational impact of this vulnerability is severe for developers using Mailpit in default configurations where authentication is not enforced via command-line flags such as --ui-auth-file. Once a user visits a malicious website containing an exploit script, the site can establish a persistent WebSocket connection to the local or network-accessible Mailpit instance. Through this unauthorized channel, the attacker gains access to sensitive data streams including live message IDs, Message-Id headers, sender and recipient email addresses, subject lines, tags, and snippets of email bodies. This constitutes a significant breach of confidentiality, potentially exposing private communications, internal infrastructure details, or credentials contained within emails if they are processed by Mailpit during testing phases. The vulnerability is classified as an authentication bypass due to the failure to enforce access controls on sensitive endpoints when accessed via manipulated URLs.
From a classification perspective, this flaw aligns with CWE-284 Improper Access Control and CWE-601 URL Redirection to Untrusted Site (Open Redirect) in the context of origin validation failures. It also maps to MITRE ATT&CK techniques related to Initial Access and Collection via browser-based exploitation vectors. The issue is a regression from earlier protections, indicating that previous fixes for WebSocket origin checks were inadvertently weakened or bypassed by changes in how URL paths are processed relative to middleware execution order. Deployments protected by the --ui-auth-file flag remain unaffected because authentication requirements override the need for strict CORS origin validation on those specific endpoints.
To mitigate this risk, organizations must immediately upgrade Mailpit to version 1.30.6 or later, where the path handling logic has been corrected to ensure consistency between middleware checks and route matching. For environments that cannot update immediately due to dependency constraints, applying a reverse proxy configuration such as Nginx or Apache is recommended. These proxies can enforce strict origin validation at the network edge before requests reach the Mailpit application server, effectively neutralizing client-side manipulation of request URIs. Additionally, administrators should ensure that authentication mechanisms are enabled for all production deployments using Mailpit to prevent unauthorized access regardless of URL encoding tricks. Regular security audits focusing on middleware ordering and path normalization practices can help identify similar architectural weaknesses in other web applications built with Go or similar frameworks.