Security readout for executives and security teams
Plain-English summary
Mailpit versions 1.28.0 and earlier have an SSRF flaw in the /proxy endpoint. An unauthenticated attacker could make the Mailpit server send HTTP GET requests to internal resources. This is most urgent where Mailpit is reachable by untrusted users or connected to sensitive internal services.
Executive priority
Treat as a timely development-infrastructure fix, not a broad enterprise emergency. Prioritize internet-facing or broadly accessible Mailpit instances first, then internal deployments that can reach sensitive services. Upgrade to 1.28.1 during the next urgent maintenance window.
Technical view
CVE-2026-21859 is CWE-918 SSRF in axllent Mailpit before 1.28.1. The /proxy endpoint permits http and https URLs but did not block internal IP addresses. Impact is limited to HTTP GET requests with minimal headers. CVSS is 5.8, network exploitable, low complexity, no privileges or user interaction required, with low confidentiality impact.
Likely exposure
Exposure is likely limited to organizations running Mailpit 1.28.0 or below, especially if the Mailpit API or UI is network-accessible beyond trusted development environments. Risk increases if the Mailpit host can reach internal metadata services, admin panels, APIs, or other private HTTP services.
Exploitation context
The provided sources do not report active exploitation, and the CVE is not marked KEV. The issue can be exploited remotely without authentication if the vulnerable /proxy endpoint is reachable. Sources state the capability is constrained to GET requests with minimal headers, which limits but does not eliminate business risk.
Researcher notes
The advisory identifies insufficient internal-address filtering in /proxy after scheme validation. The fix is linked in commit 3b9b470c093b3d20b7d751722c1c24f3eed2e19d. Evidence provided does not include proof of exploitation, broader product impact, or mitigations beyond the fixed version.
Mitigation direction
- Upgrade Mailpit to version 1.28.1 or later.
- Restrict Mailpit access to trusted development networks and users.
- Review vendor advisory and release notes for current guidance.
- Limit Mailpit host access to sensitive internal HTTP services where practical.
Validation and detection
- Inventory Mailpit deployments and record running versions.
- Confirm all instances are upgraded beyond 1.28.0.
- Review network exposure of Mailpit UI and API endpoints.
- Check whether Mailpit hosts can reach sensitive internal services.
- Review access logs for unusual /proxy endpoint activity.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-918: Information exposure and cloud metadata lookup
Information exposure and SSRF weaknesses can make discovery, cloud metadata, and credential material review relevant. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCloud metadata behavior lookup
The CVE wording references SSRF or metadata access, so cloud discovery and credential material review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2026-21859 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N3.91.4Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
5.8MediumVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/axllent/mailpit/security/advisories/GHSA-8v65-47jx-7mfrCVE reference · x_refsource_CONFIRM
- https://github.com/axllent/mailpit/commit/3b9b470c093b3d20b7d751722c1c24f3eed2e19dCVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Server-Side Request Forgery (SSRF)
Server-Side Request Forgery (SSRF) represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.