What is the CVSS score of CVE-2026-40871?

CVE-2026-40871 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of mailcow: dockerized are affected by CVE-2026-40871?

CVE-2026-40871 is a high-severity second-order SQL injection vulnerability in mailcow that allows authenticated administrators to extract sensitive data including credentials through the quarantine…. A patch is available.

How to fix or mitigate CVE-2026-40871?

Within 24 hours: Identify all mailcow instances and current versions via inventory/deployment tools. Within 7 days: Upgrade mailcow to version 2026-03b or later; if upgrade blocked, implement access controls restricting /api/v1/add/mailbox endpoint to essential administrators only and disable quarantine_notify.py scheduled job if operationally feasible. Within 30 days: Complete post-upgrade validation, audit API access logs for suspicious quarantine_category field submissions, and verify no credential compromise occurred.

mailcow: dockerized CVE-2026-40871

EUVD-2026-24253 HIGH

Improper Input Validation (CWE-20)

2026-04-21 GitHub_M

Information Disclosure Docker SQLi

7.2

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch released

Apr 22, 2026 - 21:02 nvd

Patch available

Re-analysis Queued

Apr 21, 2026 - 21:22 vuln.today

cvss_changed

Patch available

Apr 21, 2026 - 21:02 EUVD

Analysis Generated

Apr 21, 2026 - 20:50 vuln.today

EUVD ID Assigned

Apr 21, 2026 - 20:00 euvd

EUVD-2026-24253

Analysis Generated

Apr 21, 2026 - 20:00 vuln.today

CVE Published

Apr 21, 2026 - 19:12 nvd

HIGH 7.2

DescriptionGitHub Advisory

mailcow: dockerized is an open source groupware/email suite based on docker. Versions prior to 2026-03b have a second-order SQL injection vulnerability in the quarantine_category field via the Mailcow API. The /api/v1/add/mailbox endpoint stores quarantine_category without validation or sanitization. This value is later used by quarantine_notify.py, which constructs SQL queries using unsafe % string formatting instead of parameterized queries. This results in a delayed (second-order) SQL injection when the quarantine notification job executes, allowing an attacker to inject arbitrary SQL. Using a UNION SELECT, sensitive data (e.g., admin credentials) can be exfiltrated and rendered inside quarantine notification emails. Version 2026-03b fixes the vulnerability.

AnalysisAI

Second-order SQL injection in mailcow: dockerized versions prior to 2026-03b allows authenticated API users with high privileges to execute arbitrary SQL commands through the quarantine notification system. Attackers inject malicious SQL via the quarantine_category field in /api/v1/add/mailbox endpoint, which executes when quarantine_notify.py runs its scheduled job, enabling data exfiltration of admin credentials and sensitive information through UNION-based queries rendered in notification emails. No public exploit code or active exploitation confirmed at time of analysis, with vendor patch available in version 2026-03b.

Technical ContextAI

This vulnerability affects mailcow: dockerized (cpe:2.3:a:mailcow:mailcow-dockerized), a containerized open-source groupware and email suite. The flaw stems from CWE-20 (Improper Input Validation) manifesting as a second-order SQL injection. Unlike traditional SQL injection where malicious input is immediately executed, second-order SQL injection occurs when untrusted data is stored in the database and later retrieved and used in dynamically constructed SQL queries. The vulnerable code path involves the Mailcow API's /api/v1/add/mailbox endpoint accepting quarantine_category values without validation or parameterization, storing them directly. Subsequently, the quarantine_notify.py script retrieves these values and incorporates them into SQL queries using Python's unsafe % string formatting (string interpolation) rather than parameterized queries or prepared statements. When the scheduled quarantine notification job executes, the stored malicious SQL payload is injected into the query context, enabling UNION SELECT operations that can extract arbitrary data from the database and embed it in outgoing email notifications.

RemediationAI

Upgrade immediately to mailcow: dockerized version 2026-03b or later, which addresses the SQL injection vulnerability by implementing proper input validation and parameterized queries in the quarantine notification system. Follow the vendor security advisory at https://github.com/mailcow/mailcow-dockerized/security/advisories/GHSA-r8fq-wrfm-cj2q for upgrade procedures specific to containerized deployments. As compensating controls until patching is complete, implement strict API access controls by auditing and restricting high-privilege API credentials to only essential service accounts, enable comprehensive API request logging for the /api/v1/add/mailbox endpoint to detect suspicious quarantine_category values, and review existing mailbox configurations for anomalous quarantine_category entries that may contain SQL injection payloads (look for SQL keywords like UNION, SELECT, or special characters in stored values). Consider temporarily disabling automated quarantine notifications via quarantine_notify.py if immediate patching is not feasible, though this will impact legitimate quarantine management workflows. After upgrading, rotate all administrative and API credentials as a precautionary measure given the credential exfiltration capabilities of this vulnerability.