Ox Dovecot Pro CVE-2026-0394

The CVSS score of 5.3 reflects a medium-severity vulnerability with low attack complexity and no authentication requirement (PR:N), making it easily exploitable by remote, unauthenticated actors. However, real-world risk is substantially mitigated by configuration dependency: exploitation requires an administrator to have already placed per-domain passwd files in a vulnerable location (above /etc) or explicitly permitted slash characters in domain names-non-standard configurations. The lack of any public exploit code and absence of CISA KEV confirmation indicate this is not actively exploited in the wild. SSVC analysis would likely classify this as 'low' or 'defer' priority for most organizations, as it depends on unusual misconfiguration rather than a flaw triggerable by default settings. Organizations using standard /etc/dovecot/auth/ directory placement or alternative authentication schemes are unaffected. Patch availability and straightforward configuration remediation further reduce practical risk.

An attacker sending mail connection requests (via SMTP, POP3, or IMAP) crafts a malicious domain name containing path traversal sequences or slash characters that, when interpolated into the per-domain passwd file path, resolves to /etc/passwd or another sensitive file. If the file is readable by the Dovecot process, the attacker retrieves its contents, potentially extracting system user credentials or password hashes. In configurations where /etc/passwd is also treated as a userdb source, system users become unwittingly valid mail accounts, allowing authentication bypass. The network-accessible attack vector and lack of authentication requirements mean any remote attacker can attempt this without credentials, though practical impact depends on misconfiguration.