CVE-2026-21859
Medium · 5.8CVSS
5.8
EPSS
0.8%
Published
Jan 8, 2026
CISA due date
—
The record
Mailpit is an email testing tool and API for developers. Versions 1.28.0 and below have a Server-Side Request Forgery (SSRF) vulnerability in the /proxy endpoint, allowing attackers to make requests to internal network resources. The /proxy endpoint validates http:// and https:// schemes, but it does not block internal IP addresses, enabling attackers to access internal services and APIs. This vulnerability is limited to HTTP GET requests with minimal headers. The issue is fixed in version 1.28.1.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Go | github.com/axllent/mailpit | 0 | 1.28.1 |
| openSUSE:Leap 15.6 | govulncheck-vulndb | 0 | 0.0.20260114T191543-150000.1.137.1 |
Related vulnerabilities
- GO-2026-4284 Mailpit Proxy Endpoint has Server-Side Request Forgery (SSRF) vulnerability in… Same vulnerability
- GHSA-mpf7-p9x7-96r3 Mailpit is Vulnerable to Server-Side Request Forgery (SSRF) via Link Check API Also affects github.com/axllent/mailpit
- CVE-2026-27808 Mailpit is an email testing tool and API for developers. Also affects github.com/axllent/mailpit
- GO-2026-4333 Mailpit has an SMTP Header Injection via Regex Bypass in github.com/axllent/mailpit Also affects github.com/axllent/mailpit
- GO-2026-4345 Mailpit has a Server-Side Request Forgery (SSRF) via HTML Check API in… Also affects github.com/axllent/mailpit
- GO-2026-4310 Mailpit is vulnerable to Cross-Site WebSocket Hijacking (CSWSH) allowing unauthenticated… Also affects github.com/axllent/mailpit
- CVE-2026-23845 Mailpit is an email testing tool and API for developers. Also affects github.com/axllent/mailpit
- CVE-2026-23829 Mailpit is an email testing tool and API for developers. Also affects github.com/axllent/mailpit