mailcow: dockerized vulnerable to Second Order SQL Injection in quarantine category via API

published 2026-04-21 6 mo ago modified 2026-10-26 13 d ago also EUVD-2026-24253

cvss: 7.2; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 8.6%; EPSS 8.6% chance of exploitation in 30 days, percentile 95%
public exploits: 0; none known

mailcow: dockerized is an open source groupware/email suite based on docker. Versions prior to 2026-03b have a second-order SQL injection vulnerability in the quarantine_category field via the Mailcow API. The /api/v1/add/mailbox endpoint stores quarantine_category without validation or sanitization. This value is later used by quarantine_notify.py, which constructs SQL queries using unsafe % string formatting instead of parameterized queries. This results in a delayed (second-order) SQL injection when the quarantine notification job executes, allowing an attacker to inject arbitrary SQL. Using a UNION SELECT, sensitive data (e.g., admin credentials) can be exfiltrated and rendered inside quarantine notification emails. Version 2026-03b fixes the vulnerability.

Patch / fix

fixed in 1

mailcow mailcow:_dockerized 2026-03b

CISA SSVC

Exploitation: Proof of concept is public
Automatable: no
Technical impact: total
Assessed: 6 mo ago (2026-04-21)

Exploit prediction

8.57% chance of exploitation in the next 30 days, higher than 95% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

github.com https://github.com/mailcow/mailcow-dockerized/security/advisories/GHSA-r8fq-wrfm-cj2q referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CNA	3.1	7.2	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Affected products

mailcow mailcow-dockerized

Classification

Weakness

CWE-20 Improper Input Validation
CWE-89 Improper Neutralization of Special Elements used in an SQL Command
CWE-116 Improper Encoding or Escaping of Output
CWE-564 Use of Hibernate with HQL/SQL Query String Containing External Input

References

github.com /mailcow/mailcow-dockerized/security/advisories/GHSA-r8fq-wrfm-cj2q
exploit

Sources

CVE List CVE-2026-40871
NVD CVE-2026-40871

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.

Summary