5.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-27808

CVE-2026-27808: Mailpit is Vulnerable to Server-Side Request Forgery (SSRF) via Link Check API

Mailpit is an email testing tool and API for developers. Prior to version 1.29.2, the Link Check API (/api/v1/message/{ID}/link-check) is vulnerable to Server-Side Request Forgery (SSRF). The server performs HTTP HEAD requests to every URL found in an email without validating target hosts or filtering private/internal IP addresses. The response returns status codes and status text per link, making this a non-blind SSRF. In the default configuration (no authentication on SMTP or API), this is fully exploitable remotely with zero user interaction. This is the same class of vulnerability that was fixed in the HTML Check API (CVE-2026-23845 / GHSA-6jxm-fv7w-rw5j) and the screenshot proxy (CVE-2026-21859 / GHSA-8v65-47jx-7mfr), but the Link Check code path was not included in either fix. Version 1.29.2 fixes this vulnerability.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-27808

CVE-2026-27808:

5.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/axllent/mailpit	go	<= 1.29.1	1.29.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a Server-Side Request Forgery (SSRF) located in Mailpit's Link Check API and Screenshot Proxy functionality. The root cause is the application's failure to validate user-provided URLs before making HTTP requests. Specifically, the linkcheck.doHead and handlers.ProxyHandler functions used a standard Go http.Client without any restrictions on the target IP addresses.

An attacker could send an email containing specially crafted URLs pointing to internal network resources (e.g., 127.0.0.1, private IP ranges, or cloud metadata endpoints like 169.254.169.254). By triggering the Link Check API for this email, the attacker could cause the Mailpit server to make HTTP requests to these internal addresses. Because the API returns the status codes of these requests, it provides a clear feedback mechanism for the attacker to scan the internal network, identify services, and potentially access sensitive information.

The patch addresses this by implementing a safeDialContext for the http.Client. This new dialer resolves the hostname to an IP address and uses a helper function, tools.IsInternalIP, to check if the IP is a loopback, private, or otherwise reserved address. If an internal IP is detected, the request is blocked by default, thus mitigating the SSRF vulnerability. The identified vulnerable functions are the key components of the exploitation path, from the API entry point down to the function making the unsafe request.

Vulnerable functions

linkcheck.doHead

internal/linkcheck/status.go

This function performs a `HEAD` request to a given URL. Before the patch, it used a default `http.Client` without any validation of the target IP address. This allowed an attacker to force the server to make requests to internal or private IP addresses, leading to a Server-Side Request Forgery (SSRF) vulnerability.

handlers.ProxyHandler

server/handlers/proxy.go

This function acts as a proxy to fetch content from a URL, likely for generating screenshots. Similar to `linkcheck.doHead`, it used an `http.Client` without proper IP address validation, making it vulnerable to SSRF. The patch applies the same `safeDialContext` fix to prevent requests to internal addresses.

linkcheck.getHTTPStatuses

internal/linkcheck/status.go

This function orchestrates the link checking process. It iterates over a list of URLs extracted from an email and calls the vulnerable `doHead` function for each one in a separate goroutine. It is a crucial part of the exploitation chain that leads to the SSRF.

apiv1.LinkCheck

server/apiv1/other.go

This function is the API endpoint handler for the link check feature. It is the entry point for the vulnerability. When this endpoint is triggered, it initiates the process of extracting and checking links from an email, eventually calling the vulnerable `doHead` function.

linkcheck.RunTests

internal/linkcheck/main.go

This function is part of the call chain between the API endpoint (`apiv1.LinkCheck`) and the vulnerable code. It is responsible for extracting URLs from the email content before passing them to `getHTTPStatuses` for checking.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.