CVE-2026-85751 Details
Description
Mailu is a mail server distributed as a set of Docker images. From Mailu 2.0 until 2024.06.55 and prior to Mailu helm-charts 2.7.3, deployments with PROXY_AUTH_WHITELIST configured but REAL_IP_HEADER unset trusted a client-controlled X-Forwarded-By header for header-based proxy authentication. The proxy_hide_header directive in the nginx template at core/nginx/conf/proxy.conf hid the header from upstream responses but did not overwrite the incoming request value in this configuration. An unauthenticated remote attacker could therefore spoof the trusted proxy identity and bypass authentication. This issue is fixed in Mailu 2024.06.55 and Mailu helm-charts 2.7.3.
A vulnerability allowing authentication bypass in Mailu has been identified, specifically in deployments using header-based proxy authentication. This issue affects Mailu versions 2.0 through 2024.06.54, as well as Mailu helm-charts versions through 2.7.2. The vulnerability arises when the PROXY_AUTH_WHITELIST is enabled but the REAL_IP_HEADER is not set, allowing an attacker to spoof the X-Forwarded-By header and bypass authentication. The root cause is a misunderstanding of the nginx proxy_hide_header directive, which was introduced in Mailu 2.0.
Users can upgrade to Mailu version 2024.06.55 or Mailu helm-charts version 2.7.3 to address this vulnerability. For those who cannot upgrade, setting the REAL_IP_HEADER can serve as a workaround.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 21, 2026CISA-ADP
Assessed Sep 21, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Mailu/Mailu/commit/dffa97cbd889ab208246372ce9c86e99abb27ae9 | [email protected] | Source CodeVendor |
| https://github.com/Mailu/Mailu/commit/ff4003d045753013470945336448dbd790cac778 | [email protected] | Source CodeVendor |
| https://github.com/Mailu/Mailu/pull/4070 | [email protected] | Issue TrackingVendor |
| https://github.com/Mailu/Mailu/pull/4071 | [email protected] | Issue TrackingVendor |
| https://github.com/Mailu/Mailu/releases/tag/2024.06.55 | [email protected] | Release NotesVendor |
| https://github.com/Mailu/Mailu/security/advisories/GHSA-rfhj-4wcq-74xg | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-290 | Authentication Bypass by Spoofing | [email protected] |
| CWE-807 | Reliance on Untrusted Inputs in a Security Decision | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Mailu | >= 2.0, <= 2024.06.54 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 21, 2026 | CVE Modified | CISA-ADP |
| Sep 21, 2026 | New CVE Received | [email protected] |