Skip to main content

OX Dovecot Pro CVE-2026-27851

| EUVDEUVD-2026-29467 CRITICAL
Improper Handling of Extra Parameters (CWE-235)
2026-05-12 OX GHSA-xfpv-rrgm-4qqr
Code Injection Ox Dovecot Pro Open Xchange Gmbh
9.1
CVSS 3.1 · NVD
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Reach IMAP/POP3/auth login endpoint
  2. Delivery
    Submit crafted username/credential payload
  3. Exploit
    Safe-filter flag skips downstream escaping
  4. Execution
    Payload injected into SQL/LDAP auth query
  5. Impact
    Bypass authentication or exfiltrate backend data

Vulnerability Assessment

Weakness
CWE
CWE-235
Exploitation Conditions

Exploitation requires that the OX Dovecot Pro deployment uses the 'safe' filter within variable expansion in its authentication backend configuration (the passdb/userdb SQL or LDAP query templates) - this server-side configuration is the concrete prerequisite stated in the description ('when safe filter is used with variable expansion ... when used in authentication'). Given that condition, no attacker authentication or user interaction is needed: the CVSS vector is PR:N/UI:N/AV:N/AC:L, i.e. remote and unauthenticated against the login path. The principal limiting factor is therefore configuration-dependent: deployments that do not use the 'safe' filter in auth expansion are not exploitable, which is why SSVC marks Automatable 'no' and EPSS is near zero. Affected only on OX Dovecot Pro at or below 2.4.3 (2.x) and 3.1.4 (3.x).
Impact

Signals are mixed but lean toward a genuine high-severity issue with currently low observed exploitation. CVSS 3.1 is 9.1 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:N) reflecting a remote, unauthenticated path with high confidentiality and integrity impact and no availability impact - consistent with injection enabling auth bypass or data disclosure rather than crash. CISA SSVC corroborates severity (Technical Impact: total) but rates Exploitation 'none' and Automatable 'no', and EPSS is 0.01% (2nd percentile), and the vulnerability is NOT in CISA KEV - so there is no evidence of active or large-scale exploitation. A key qualifying factor: exploitability is contingent on the deployment actually using the 'safe' filter within variable expansion in its authentication configuration, which CVSS does not capture as an attacker prerequisite. Net: treat as a high priority to patch for any OX Dovecot Pro operator using safe-filter-based auth queries, but the absence of KEV listing, a public POC, and the very low EPSS indicate this is not currently under widespread automated attack.
Exploit ScenarioDerived

An attacker submits crafted credential or username data to the mail server's login interface; because the 'safe' filter erroneously marks following pipeline output as already-escaped, the malicious payload is passed unescaped into the SQL or LDAP authentication query, allowing the attacker to manipulate the query to bypass authentication or read backend data. No special privileges or user interaction are required (AV:N/AC:L/PR:N/UI:N), though success depends on the server using the 'safe' filter in its auth expansion. No public exploit code is known at time of analysis.
Act Now Prioritize within 24-48h. Why: CRITICAL severity.
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv3 – Jun 30, 2026

Authentication-layer injection in OX Dovecot Pro (versions up to and including 2.4.3 and 3.1.4) arises from a flaw in the 'safe' template filter: when 'safe' is applied during variable expansion, every subsequent pipeline stage on the same string inherits the 'safe' designation, so attacker-controlled data that should be escaped is passed through unescaped. Because variable expansion is used to build authentication backend queries, this enables SQL or LDAP injection by remote unauthenticated attackers. There is no public exploit identified at time of analysis, and EPSS exploitation probability is negligible (0.01%, 2nd percentile).

Earlier versions of this analysis (2)
v2 Jun 30, 2026 - 03:33 cvss changed CVSS 9.1

Authentication-layer SQL/LDAP injection in OX Dovecot Pro arises from a flaw in variable expansion: once the 'safe' filter is applied to a string, every subsequent pipeline stage on that same string is also treated as already-escaped, so attacker-controlled data passes through unescaped. This affects OX Dovecot Pro builds at or below 2.4.3 and 3.1.4 whose authentication configuration relies on the safe filter, and lets a remote attacker inject crafted input into auth queries. No public exploit identified at time of analysis, EPSS is negligible (0.01%), and CISA SSVC marks exploitation as none, but technical impact is rated total.

v1 May 12, 2026 - 14:15 CVSS 7.4

Improper neutralization in OX Dovecot Pro's safe filter allows injection attacks when variable expansion is used, bypassing input sanitization on subsequent pipelines. Network-accessible attackers can exploit this filter logic flaw to inject malicious SQL or LDAP queries during authentication workflows, potentially enabling unauthorized access or data exfiltration. CVSS 7.4 with network vector but high complexity. No public exploit code identified at time of analysis, though vendor advisory confirms the vulnerability enables SQL/LDAP injection in authentication contexts.

RemediationAI

Patch available per vendor advisory: upgrade OX Dovecot Pro to a fixed release above the affected 2.4.3 and 3.1.4 branches as specified in Open-Xchange advisory oxdc-adv-2026-0002 (https://documentation.open-xchange.com/dovecot/security/advisories/csaf/2026/oxdc-adv-2026-0002.json); the exact fixed version numbers should be taken directly from that advisory and the matching distro notices (Ubuntu USN-8365-1, Red Hat CSAF VEX) rather than assumed. As an explicit interim workaround the vendor recommends avoiding use of the 'safe' filter until on a fixed version - review passdb/userdb and any auth-related variable-expansion configuration and remove or rewrite pipelines that rely on 'safe' for SQL/LDAP escaping, substituting backend-native parameterization or known-good escaping; the trade-off is that auth query templates may need rework and testing to preserve correct login behavior. Where immediate config changes are not feasible, restrict and monitor authentication inputs and prioritize the upgrade.

Affected VersionsENISA

OX Dovecot Pro 0 ≤2.4.3
OX Dovecot Pro 0 ≤3.1.4

Affected Packages

euvd ox_dovecot_pro no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

Dovecot is a widely-used IMAP/POP3 mail server; OX Dovecot Pro is Open-Xchange's supported enterprise distribution (CPE cpe:2.3:a:open-xchange_gmbh:ox_dovecot_pro). Dovecot's configuration uses a variable-expansion/templating syntax where filters can be chained in pipelines (e.g. %{variable | filter | filter}). The 'safe' filter is meant to mark a single value as already neutralized for a given context (such as SQL or LDAP query construction). The defect is a state-tracking error: once 'safe' is encountered, the 'safe' flag is not reset for following filters/pipelines operating on the same string, so escaping that should occur downstream is skipped. The assigned CWE-235 (Improper Handling of Extra Parameters) points to the parser/expansion logic mishandling subsequent pipeline elements; the practical consequence is an injection class flaw (the tags label it 'Code Injection') when this expansion feeds userdb/passdb SQL or LDAP lookups during login.

Know when Ox Dovecot Pro gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 9.1 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
vuln.today AI 9.1 CRITICAL

Pre-auth injection in the login path gives AV:N/PR:N/UI:N; AC:L since no attacker-side hurdle (config dependency is server-side, not an attack condition); C:H/I:H for auth bypass/data access, A:N as no availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
SUSE 7.4 HIGH
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Red Hat 7.4 HIGH

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None

Lifecycle Timeline

3
Severity Changed
Jun 30, 2026 - 03:24 NVD
HIGH CRITICAL
CVSS changed
Jun 30, 2026 - 03:24 NVD
7.4 (HIGH) 9.1 (CRITICAL)
CVE Published
May 12, 2026 - 13:28 nvd
HIGH 7.4

DescriptionNVD

When safe filter is used with variable expansion, all following pipelines on the same string are incorrectly interpreted as safe too, enabling unsafe data to be unescaped. This can enable SQL / LDAP injection attacks when used in authentication. Avoid using safe filter until on fixed version. No publicly available exploits are known.

Executive ViewAI

Why It Matters

OX Dovecot Pro mail servers running versions 2.4.3 or earlier, or 3.1.4 or earlier, are vulnerable to a critical remote authentication-bypass vulnerability (CVE-2026-27851, CVSS 9.1) exploitable without credentials. No public exploit identified at time of analysis; however, attackers could inject malicious SQL or LDAP commands into authentication queries to gain unauthorized email system access and potentially compromise data.

Business Impact: Severe
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.0%
Top 98% exploitable
Prevalence
Medium
enterprise Dovecot distribution; common in mail infrastructure but vendor-specific Pro edition
Social Media
1
Sightings
Data Quality
7 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment Vendor CIRCL VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity CRITICAL
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
CRITICAL severity
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
No
Human Impact
Very High
Technical Impact
Total

Priority Score

46
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +46
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Code Injection CRITICAL

Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.

More in Ox Dovecot Pro

View all
CVE-2026-42007 CRITICAL
9.1 Aug 28

Use-after-free in the OX Dovecot Pro and Dovecot CE mail-editing code lets an authenticated user who can install a Sieve
CVE-2026-24031 HIGH
8.2 Mar 27

Authentication bypass and user enumeration in OX Dovecot Pro (versions up to and including 3.1.0 and the 2.4.x line up t
CVE-2026-27860 LOW POC
3.7 Mar 27

Open-Xchange Dovecot Pro contains an LDAP filter injection vulnerability in its authentication module that allows remote
CVE-2026-42391 HIGH
7.5 Aug 28

Denial of service in OX Dovecot Pro and OX Dovecot CE allows unauthenticated remote attackers to exhaust memory and CPU

CVE-2026-33605 HIGH
7.5 Aug 28

ManageSieve login process in OX Dovecot CE and Pro crashes on receipt of a small malformed pre-authentication command, e
CVE-2026-27852 HIGH
7.5 Aug 28

Memory exhaustion in OX Dovecot Pro and OX Dovecot CE allows any remote sender to deny IMAP service to a targeted user b
CVE-2025-59028 HIGH
7.5 Mar 27

Unauthenticated remote attackers can disrupt authentication on OX Dovecot Pro servers by sending malformed base64 SASL d
CVE-2025-59032 HIGH
7.5 Mar 27

OX Dovecot Pro ManageSieve service crashes when processing AUTHENTICATE commands with SASL initial responses using liter
CVE-2026-27858 HIGH
7.5 Mar 27

OX Dovecot Pro managesieve-login process crashes repeatedly due to memory exhaustion triggered by unauthenticated attack
CVE-2026-27857 HIGH
7.5 Mar 27

Remote memory-exhaustion denial of service in OX Dovecot Pro (versions up to and including 2.3.0) lets an unauthenticate
CVE-2026-40018 HIGH
7.4 Aug 28

SQL injection in Open-Xchange OX Dovecot Pro and OX Dovecot CE enables unauthenticated remote attackers, under high-comp
CVE-2026-73208 HIGH
7.4 Aug 28

OAuth2 token validation in OX Dovecot Pro and OX Dovecot CE contains a logic error that permits authentication bypass wh

Same weakness CWE-235 – Improper Handling of Extra Parameters

View all
CVE-2024-47651 HIGH
7.1
CVE-2026-20083 MEDIUM
6.5

Same technique Code Injection

View all
CVE-2023-3519 CRITICAL POC
9.8
CVE-2021-22205 CRITICAL POC
10.0
CVE-2024-23692 CRITICAL POC
9.8
CVE-2012-0158 HIGH POC
8.8
CVE-2021-44529 CRITICAL POC
9.8
CVE-2014-6287 CRITICAL POC
9.8
CVE-2017-7494 CRITICAL POC
9.8
CVE-2025-24893 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: High
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise Module for Server Applications 15 SP7 Fixed
SUSE Linux Enterprise Module for Server Applications 15 SP7 Fixed

References

Advisories & patches
ADVISORY https://documentation.open-xchange.com/dovecot/security/advisories/csaf/2026/oxdc-adv-2026-0002.json ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-27851 ADVISORY https://ubuntu.com/security/notices/USN-8365-1 ADVISORY https://vuldb.com/vuln/363034 REF https://access.redhat.com/security/cve/CVE-2026-27851 REF https://bugzilla.redhat.com/show_bug.cgi?id=2476471 REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-27851.json

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy