Description
Mailpit is an email testing tool and API for developers. Prior to 1.30.2, the remediation shipped for CVE-2026-27808 is incomplete because the tools.IsInternalIP deny-list in internal/tools/net.go relies on Go's standard library classification helpers and does not block IPv6 transition mechanisms or prefixes such as NAT64, 6to4, IPv4-compatible IPv6, ISATAP, fec0::/10, and 2001:db8::/32. An attacker who can deliver email and invoke POST /api/v1/message/{ID}/link-check can coerce the Link Check API's safeDialContext path into dialing internal destinations and can use status-code and error feedback to map internal service reachability, including cloud metadata endpoints. This issue is fixed in version 1.30.2.
Published: 2026-07-10
Score: 5.8 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Mailpit is an email testing tool and API for developers that validates hyperlinks by making outbound HTTP requests. The Link Check API uses a safeDialContext path to perform these requests. Prior to version 1.30.2 the fix for CVE-2026-27808 was incomplete, because the internal IP deny-list in tools.IsInternalIP relies on Go’s standard library helpers and fails to block IPv6 transition mechanisms or prefixes such as NAT64, 6to4, IPv4-compatible IPv6, ISATAP, fec0::/10 and 2001:db8::/32. An attacker who can deliver an email and then POST /api/v1/message/{ID}/link-check can coerce the API into dialing these internal destinations. Status-code and error feedback expose internal service reachability, including cloud metadata endpoints, allowing the attacker to perform network reconnaissance. This SSRF weakness (CWE-918) does not permit direct code execution. The vulnerability is fixed in Mailpit v1.30.2.

Affected Systems

The issue affects axllent:mailpit. Users running any installation older than version 1.30.2 are vulnerable.

Risk and Exploitability

The CVSS score of 5.8 indicates a moderate impact. The EPSS score is <1%, indicating a low likelihood of exploitation, and the vulnerability is not listed in KEV. Exploitation requires the POST /api/v1/message/{ID}/link-check. Attackers can map internal reachability but cannot directly execute code. The incomplete SSRF and the primary attack vector is through the Link Check API’s safeDialContext path addresses.

Generated by OpenCVE AI on July 29, 2026 at 09:51 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Mailpit to version 1.30.2 to eliminate the incomplete SSRF protection.
  • Verify that the internal IP deny‑list configuration includes IPv6 transition prefixes and monitor logs for unexpected outbound connections to internal hosts.
  • Configure firewall or network segmentation to block unauthorized outbound traffic from the Mailpit service to internal IP ranges that are not required, focusing on IPv6 transition prefixes.

Generated by OpenCVE AI on July 29, 2026 at 09:51 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-w4mc-hhc6-xp28 Mailpit: Incomplete SSRF protection in Link Check API via IPv6 transition mechanisms
History

Mon, 13 Jul 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sat, 11 Jul 2026 00:00:00 +0000

Type Values Removed Values Added
First Time appeared Axllent
Axllent mailpit
Vendors & Products Axllent
Axllent mailpit

Fri, 10 Jul 2026 22:00:00 +0000

Type Values Removed Values Added
Description Mailpit is an email testing tool and API for developers. Prior to 1.30.2, the remediation shipped for CVE-2026-27808 is incomplete because the tools.IsInternalIP deny-list in internal/tools/net.go relies on Go's standard library classification helpers and does not block IPv6 transition mechanisms or prefixes such as NAT64, 6to4, IPv4-compatible IPv6, ISATAP, fec0::/10, and 2001:db8::/32. An attacker who can deliver email and invoke POST /api/v1/message/{ID}/link-check can coerce the Link Check API's safeDialContext path into dialing internal destinations and can use status-code and error feedback to map internal service reachability, including cloud metadata endpoints. This issue is fixed in version 1.30.2.
Title Mailpit: Incomplete SSRF protection in Link Check API via IPv6 transition mechanisms (follow-up to CVE-2026-27808)
Weaknesses CWE-918
References
Metrics cvssV3_1

{'score': 5.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N'}

Subscriptions

Axllent Mailpit
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-07-13T15:55:15.065Z

Reserved: 2026-06-16T15:20:43.086Z

Link: CVE-2026-55187

cve-icon Vulnrichment

Updated: 2026-07-13T15:54:45.559Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-29T10:00:15Z

Weaknesses
  • CWE-918

    Server-Side Request Forgery (SSRF)