Seppmail CVE-2026-29138

The risk is moderately high in targeted email security deployments. Attack vector is network-based (email delivery) with low complexity, requiring only crafted email address construction-no special privileges are needed. However, real-world impact depends on organizational reliance on PGP signature verification for authentication and trust decisions; in environments where signatures are manually verified or distrusted by default, practical risk is lower. The absence of CVSS and EPSS data, combined with no confirmed KEV or public POC in provided references, suggests this is a lower-profile vulnerability than critical remote code execution issues, yet signature forgery in encrypted email is a serious trust boundary violation. Organizations using SEPPmail for compliance-sensitive communications (e.g., financial, healthcare) should prioritize patching.

An attacker crafts an email containing a specially formatted email address (e.g., with LDAP injection payloads embedded in the From or Reply-To field) and sends it through or to the vulnerable SEPPmail gateway. The gateway parses the address for signature verification, but fails to sanitize LDAP metacharacters, allowing the attacker's address to be mapped to an existing legitimate user's PGP signature in the LDAP directory. When recipients view the email, the system displays the attacker's address alongside a valid PGP signature belonging to the legitimate user, falsely indicating the attacker sent a signed message from the legitimate user's identity. No public exploit code has been identified in the provided data.