Loading story…
A second-order SQL injection vulnerability tracked as CVE-2026-40871 affects mailcow-dockerized through the Mailcow API's quarantine_category field. The flaw originates in the /api/v1/add/mailbox endpoint, which stores attacker-controlled input without validation or sanitization; that value is later processed by quarantine_notify.py, where SQL queries are constructed with unsafe Python % string formatting instead of parameterized statements. Because the payload is written first and executed only when the quarantine notification job runs, the issue is a delayed second-order injection rather than an immediate SQL injection at the API endpoint.
The disclosed impact includes arbitrary SQL execution, UNION SELECT-based data exfiltration, and exposure of sensitive internal information in quarantine notification emails, including administrator credentials. The advisory warns that an attacker with Mailcow API access could use the bug to retrieve internal data and potentially pivot toward broader system compromise. A documented attack chain also describes combining an XSS flaw in SOGo to steal an API key, then using that access to plant the SQL payload and leak credentials through the quarantine email workflow.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
A GitHub-hosted vulnerability disclosure for CVE-2026-40871 was published, documenting the same Mailcow second-order SQL injection issue. This appears to be a separate publication of the vulnerability rather than a new incident development.
A security advisory disclosed a second-order SQL injection vulnerability in Mailcow's API quarantine_category handling, where unsanitized input stored via /api/v1/add/mailbox is later executed by quarantine_notify.py using unsafe SQL string formatting. The advisory said the flaw could enable arbitrary SQL execution, data exfiltration, leakage of administrator credentials in quarantine emails, and possible further compromise by an attacker with API access.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
github.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Openfind **MailGates/MailAudit** and **Sagredo qmail** were disclosed with critical remote code execution vulnerabilities that could let attackers compromise exposed mail infrastructure. **CVE-2026-6350** affects Openfind MailGates/MailAudit and is a stack-based buffer overflow (`CWE-121`) that allows an unauthenticated remote attacker to control execution flow and run arbitrary code. The flaw carries a **CVSS v3.1** score reflecting network exploitation with no privileges or user interaction and high impact across confidentiality, integrity, and availability, and was referenced in advisories published by **TWCERT/CC**. A second flaw, **CVE-2026-41113**, affects **Sagredo qmail** versions before `2026.04.07` and enables remote code execution through `tls_quit` because `qmail-remote.c` uses `popen` in the `notlshosts_auto` component, a command injection issue tracked as `CWE-78`. The vulnerability was documented with references to public research, a GitHub publications repository, the fixing commit, pull request `#42`, and the patched `v2026.04.07` release, giving defenders a clear remediation path while underscoring the risk to internet-facing email systems.
Jun 29, 2026
A **remote code execution** flaw tracked as **`CVE-2026-41113`** was disclosed in the `sagredo-dev/qmail` fork after researchers found that `qmail-remote` could build and execute a shell command from an attacker-controlled MX hostname. The bug sits in `tls_quit()` and was introduced by the `notlshosts_auto` feature added in October 2024, which automatically records hosts that fail TLS. If a target mail server sends mail to a domain whose DNS MX record is controlled by an attacker, a crafted hostname containing shell metacharacters can be passed through `sprintf()` into `popen()`, allowing arbitrary commands to run as the **`qmailr`** user when `control/notlshosts_auto` is enabled. The issue affects `sagredo-dev/qmail` versions **`v2024.10.26` through `v2026.04.02`** and was fixed in **`v2026.04.07`** by commit **`749f607`**, which removes shell execution, adds stricter FQDN validation, and replaces the vulnerable logic with safer file handling using `open()` and `snprintf()`. Public writeups and a GitHub repository published technical analysis, a Docker-based reproduction environment, and proof-of-concept exploit material showing the chain from crafted DNS responses to command execution, with one example writing `id` output to `/tmp/qmail_rce_proof`. The vulnerability carries a reported **CVSS 3.1 score of 8.2 (High)**, and maintainers advised users of the community-patched qmail fork—not original `qmail 1.03`—to upgrade immediately.
Jun 29, 2026
A critical SQL-injection flaw in Roundcube Webmail's `virtuser_query` plugin, tracked as **CVE-2026-48842**, is being actively exploited in the wild. The pre-authentication vulnerability stems from a backslash-escaping bypass in PHP's `preg_replace` handling and can allow an attacker to manipulate database queries before logging in, provided the vulnerable plugin is enabled and reachable. The Canadian Centre for Cyber Security cited open-source reporting confirming exploitation and urged organizations to act immediately. Affected deployments include Roundcube versions earlier than **1.6.16** in the 1.6 LTS branch and earlier than **1.7.1** in the 1.7 branch; administrators should update exposed instances, verify whether `virtuser_query` is enabled, and review web, application, database, and authentication logs for compromise indicators.
Sep 28, 2026