EUVD-2026-23321
GHSA-j23v-33r7-63rx
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
AV:N as the trigger comes from a remote peer; AC:H because it needs the non-default notlshosts_auto feature plus the obsolete-TLS branch; PR:N since the victim requires no attacker auth; full CIA as injected commands run as the qmailr user.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
6DescriptionCVE.org
sagredo qmail before 2026.04.07 allows tls_quit remote code execution because of popen in notlshosts_auto in qmail-remote.c.
AnalysisAI
Remote code execution in sagredo qmail before 2026.04.07 arises because the notlshosts_auto TLS-fallback feature in qmail-remote.c builds a /bin/touch shell command with the remote partner's FQDN and runs it through popen(), enabling OS command injection when that FQDN carries shell metacharacters. An operator-controlled remote mail server (or attacker able to control the MX/hostname a victim delivers to) can inject commands that execute as the qmail-remote (qmailr) user. Publicly available exploit code exists per the SSVC proof-of-concept rating, but it is not listed in CISA KEV and EPSS is very low (0.08%), indicating no evidence of widespread exploitation.
Technical ContextAI
qmail is a mail transfer agent; this is the sagredo-dev distribution that bundles netqmail-1.06 with community TLS/auth patches. The flaw is in qmail-remote, the outbound SMTP delivery client. A patch added to auto-manage TLS downgrade decisions writes a file at control/notlshosts/<partner_fqdn> when control/notlshosts_auto contains a value greater than 0. The vulnerable implementation used sprintf() to assemble '/bin/touch <qmail_dir>/control/notlshosts/'<partner_fqdn>'' and executed it via popen(), a classic CWE-78 (OS Command Injection). Because partner_fqdn is derived from the remote peer rather than sanitized, a single-quote and shell operators break out of the quoting and inject arbitrary commands. The fix (commit 749f607) removes popen entirely, replacing it with a direct open()/close() file creation guarded by a strict is_valid_fqdn() validator that restricts characters to [A-Za-z0-9-] and dots, eliminating the shell path. No CPE strings were provided in the input.
RemediationAI
Vendor-released patch: 2026.04.07 - upgrade sagredo qmail to release v2026.04.07 (https://github.com/sagredo-dev/qmail/releases/tag/v2026.04.07), which removes the popen()/touch shell invocation in qmail-remote.c and replaces it with validated direct file creation (commit 749f607, PR #42). If immediate upgrade is not possible, the most direct compensating control is to disable the automatic TLS-fallback feature by setting control/notlshosts_auto to 0 (or removing the file), which eliminates the vulnerable code path entirely; the trade-off is that qmail-remote will no longer auto-skip TLS for remote servers with obsolete TLS, so delivery to such hosts may fail or require manually maintaining control/notlshosts entries. As a defense-in-depth measure, ensure qmail-remote runs as an unprivileged, tightly confined user so that any injected command has minimal reach. Review the vendor discussion at http://www.openwall.com/lists/oss-security/2026/04/18/5 and the audit writeup https://blog.calif.io/p/we-asked-claude-to-audit-sagredos.
Same weakness CWE-78 – OS Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today