What is the CVSS score of CVE-2026-27602?

CVE-2026-27602 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Python are affected by CVE-2026-27602?

Modoboa mail server installations are vulnerable to command injection attacks by authenticated administrative users, potentially allowing attackers with reseller or superadmin credentials to gain…. A patch is available.

How to fix or mitigate CVE-2026-27602?

Within 24 hours: Inventory all Modoboa deployments and identify versions currently in use; restrict administrative access to trusted personnel only. Within 7 days: Apply patch to version 2.7.1 or later on all affected systems, prioritizing production mail servers. Within 30 days: Conduct post-patch validation, review administrative access logs for suspicious activity, and implement principle of least privilege for reseller accounts.

Python CVE-2026-27602

EUVD-2026-15951 HIGH

OS Command Injection (CWE-78)

2026-03-25 https://github.com/modoboa/modoboa

GHSA-wwv8-cqpr-vx3m

Python Command Injection OpenSSL

7.2

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 25, 2026 - 17:17 euvd

EUVD-2026-15951

Analysis Generated

Mar 25, 2026 - 17:17 vuln.today

Patch released

Mar 25, 2026 - 17:17 nvd

Patch available

CVE Published

Mar 25, 2026 - 17:03 nvd

HIGH 7.2

DescriptionGitHub Advisory

Summary

exec_cmd() in modoboa/lib/sysutils.py always runs subprocess calls with shell=True. Since domain names flow directly into shell command strings without any sanitization, a Reseller or SuperAdmin can include shell metacharacters in a domain name to run arbitrary OS commands on the server.

Details

The root cause is in modoboa/lib/sysutils.py:31:

python

kwargs["shell"] = True
process = subprocess.Popen(cmd, **kwargs)

When a create a domain is created with DKIM enabled, the domain name gets embedded into a shell command like this:

python

exec_cmd(f"openssl genrsa -out {dkim_storage_dir}/{domain.name}.pem {key_size}")

If the domain name contains something like $(id>/tmp/proof).example.com, the shell executes the injected command before running openssl.

The same pattern appears in several other places:

modoboa/admin/jobs.py:38 - mailbox rename via mv using full_address
modoboa/amavis/lib.py:202 - sa-learn using domain.name
modoboa/admin/models/mailbox.py:150 - doveadm user using full_address
modoboa/maillog/graphics.py:105-107 - rrdtool using domain.name
modoboa/webmail/models.py:54-57 - doveadm move/delete using account.email

PoC

Deploy modoboa <= 2.7.0
Log in as a Reseller or SuperAdmin
Create a new domain named $(id>/tmp/proof).example.com with DKIM enabled
SSH into the server and read /tmp/proof

Something like this will be displayed:

uid=0(root) gid=0(root) groups=0(root)

Confirmed on commit b521bcb4f (latest main at time of discovery).

Impact

An attacker with Reseller-level access (or higher) can execute arbitrary OS commands on the mail server - in a typical Modoboa deployment this means running as root. All six identified sinks are reachable through normal application workflows.

AnalysisAI

Modoboa, an open-source mail server management platform, contains a command injection vulnerability in its subprocess execution handler that allows authenticated Reseller or SuperAdmin users to execute arbitrary operating system commands. A proof-of-concept exploit exists demonstrating how shell metacharacters in domain names can achieve code execution, typically as root in standard deployments. The vulnerability affects modoboa versions up to and including 2.7.0, with patches available in version 2.7.1.

Technical ContextAI

This vulnerability stems from CWE-78 (OS Command Injection) in the exec_cmd() function within modoboa/lib/sysutils.py, which unconditionally sets shell=True when invoking subprocess.Popen(). The affected product is identified by CPE pkg:pip/modoboa. Multiple code paths pass unsanitized user-controlled data (domain names, email addresses, mailbox names) directly into shell command strings that invoke external utilities including openssl (for DKIM key generation), mv (mailbox operations), sa-learn (spam filtering via Amavis), doveadm (Dovecot administration), and rrdtool (logging graphics). When shell=True is enabled, subprocess executes commands through /bin/sh, allowing shell metacharacters like $(), backticks, semicolons, and pipes to break out of the intended command context and execute arbitrary code. Six distinct injection points have been identified across the codebase, all sharing the same root cause of shell-enabled subprocess calls combined with missing input validation.

RemediationAI

Upgrade Modoboa to version 2.7.1 or later, which addresses the command injection vulnerability through proper input sanitization and safer subprocess invocation patterns. The fix commit is available at https://github.com/modoboa/modoboa/commit/27a7aa133d3608fe8c25ae39125d1012c333cbfa and the patched release can be obtained from https://github.com/modoboa/modoboa/releases/tag/2.7.1. Organizations unable to immediately upgrade should implement compensating controls including restricting Reseller and SuperAdmin account creation to only highly trusted administrators, implementing additional input validation at the web application firewall layer to block domain names containing shell metacharacters, auditing existing domain names for suspicious patterns, and monitoring system logs for unexpected process executions from the Modoboa application context. Network segmentation limiting the mail server's ability to initiate outbound connections can also reduce post-exploitation impact.