CVE-2026-67448

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-67448
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-67448.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-67448
Aliases
Published
2026-08-20T21:29:06.185Z
Modified
2026-08-23T03:42:35.662493933Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N CVSS Calculator
Summary
Mailpit: WebSocket origin check bypass via percent-encoded path (regression of CVE-2026-22689)
Details

Mailpit is an email testing tool and API for developers. From 1.29.0 until 1.30.6, Mailpit's server/server.go origin middleware checks the raw RequestURI for the /api/ prefix while Go's ServeMux routes using the percent-decoded URL path, and server/websockets/client.go configures websocket.Upgrader.CheckOrigin to return true. A malicious website can request /%61pi/events, skip corsOriginAccessControl(), reach the /api/events WebSocket handler, and receive live message IDs, Message-Id values, sender and recipient fields, subjects, tags, and body snippets from an unauthenticated default Mailpit instance after the user visits the site. This is a regression of the earlier WebSocket origin protection and does not affect deployments protected by --ui-auth-file. This issue is fixed in version 1.30.6.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/67xxx/CVE-2026-67448.json",
    "cwe_ids": [
        "CWE-177",
        "CWE-200",
        "CWE-346"
    ],
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/axllent/mailpit

Affected ranges

Type
GIT
Repo
https://github.com/axllent/mailpit
Events
Introduced
43b8ba3dc6c16bd3b10fc40416c8920a85feeb3b
Fixed
fbe5e006c3f1682b819df58b4a932d7a84920be9
Fixed
a58a22122eb5259b24e34bd33b7274d046606364
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "1.29.0"
        },
        {
            "fixed": "1.30.6"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

v1.*
v1.29.0
v1.29.1
v1.29.2
v1.29.3
v1.29.4
v1.29.5
v1.29.6
v1.29.7
v1.30.0
v1.30.1
v1.30.2
v1.30.3
v1.30.4
v1.30.5

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-67448.json"