Mailpit's internal IP denial list fails to block the Azure WireServer address 168.63.129.16 and the RFC 2765/6145 IPv6 prefix. This allows attackers to reference these internal addresses through hostnames embedded in email bodies, enabling server‑side request forgery against Mailpit's link‑check API and proxy endpoints. Successful exploitation could let an attacker reach internal network services and exfiltrate information or perform additional internal attacks. The weakness is classified as CWE‑918, indicating a server‑side request forgery vulnerability.

The affected product is Mailpit from axllent. Versions including 1.31.0 and earlier are impacted because the IsInternalIP function is unpatched in those releases. The vulnerability is present in the source code references for v1.31.0, thus any deployment running that or earlier is susceptible unless a post‑release fix is applied.

The CVSS score of 6.9 indicates a medium severity. No EPSS score is available, so the current exploit likelihood cannot be quantified, and the vulnerability is not listed in CISA's KEV catalog. The attack vector is inferred to be through crafted email content that resolves to the prohibited addresses, which the Mailpit server then processes, leading to outbound requests to internal hosts. Because the weakness allows full remote control over internal request destinations, the potential impact is significant, though the precise likelihood depends on the target's exposure and network segmentation.