mailcow Vulnerability Details and Proof-of-Concept Steps Published for Five Flaws, Including Cross-Tenant RCE
Do Son 
TL;DR
The mailcow team published five security advisories on November 10, 2026, for its open-source mailcow-dockerized mail server suite. The most severe of these mailcow vulnerabilities, rated CVSS 9.1, lets a single domain admin run code in a container shared by every tenant. Notably, the advisories include full technical write-ups and proof-of-concept steps. Fixes shipped in releases 2026-07a and 2026-11.
Five flaws range from stored XSS and SMTP injection to unlimited password guessing and remote code execution. Public advisories now spell out how each bug works and how to reproduce it. Update mailcow-dockerized to 2026-11 or later.
Why It Matters
mailcow can host many domains, each with its own domain admins, on one server. As a result, flaws that cross tenant lines carry extra weight. One advisory warns that a tenant admin “reads/modifies/injects every tenant’s mail in transit and disables filtering platform-wide.”
Because the vulnerability details and proof-of-concept steps are now public, attackers have a clear roadmap. Even so, no exploitation in the wild has been reported, and no CVE IDs have been assigned yet.
How the Attack Works
Cross-tenant RCE via footer template (CVE-2026-125757, CVSS 9.1)
Domain admins can set a domain-wide email footer. However, rspamd renders that footer as a Jinja template on every outbound message. A sandbox gap in the template engine lets template code reach system commands. The code then runs inside the shared rspamd container that scans mail for all domains.
Stored XSS in admin log tables (GHSA-xrq6-h4qm-x38v, CVSS 8.3)
Here, an outside sender needs no account. The attacker places script in a mail header such as the Message-ID. When an admin opens the Rspamd history or Ratelimits log, the script runs in the admin’s session.
Domain admin to super admin (GHSA-76cm-26jx-jmhr, CVSS 8.1)
A domain admin can plant script in a mailbox’s Full name field. The super admin’s Mailboxes page renders it without escaping. Since mailcow ships no Content-Security-Policy, the script can take over the whole instance.
SMTP injection in quarantine release (GHSA-5928-v56c-g8x5, CVSS 7.4)
The default raw release format skipped dot-stuffing. Therefore, a crafted quarantined message can inject SMTP commands once a user releases it. Injected mail bypasses spam and virus filters and can relay from the server’s IP address.
Unlimited password guessing (GHSA-rpvp-3pw9-3vcw, CVSS 7.4)
Failed ActiveSync, CalDAV/CardDAV and autodiscover logins were logged as coming from 127.0.0.1. Since netfilter ignores loopback addresses, attackers were never banned. In addition, autodiscover revealed which mailboxes exist, along with owner names.
Affected Versions
- Footer RCE and brute-force flaws: mailcow-dockerized before 2026-11
- Log XSS, Full name XSS and SMTP injection: before 2026-07a
Patch and Mitigation
Update to release 2026-11, which covers all five mailcow vulnerabilities. If you cannot update yet, set the quarantine release format to “attachment” to block the SMTP injection. For the brute-force issue, the team states there is no workaround. Also, review domain admin accounts and recent footer changes for unexpected template code.
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
