OX Dovecot CVE-2026-42008

Exploitation requires both of the following conditions simultaneously: (1) the attacker must control or originate requests from a host explicitly listed in Dovecot's trusted proxy network configuration (login_trusted_networks or equivalent) - deployments with no trusted proxies configured are completely unaffected; and (2) the configured passdb backend must honour a field that permits authentication without a password (such as a nopassword flag or equivalent mechanism). Neither condition alone is sufficient. The Adjacent network vector (AV:A) means exploitation cannot be initiated from the public internet without first gaining access to the trusted proxy network segment. Normal end-user credentials and unauthenticated external network access are insufficient to trigger the vulnerability.

The published CVSS 3.1 score of 4.3 (AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) appears to materially understate real-world impact: an authentication bypass that enables full impersonation of arbitrary mail users in an IMAP server would typically carry High confidentiality and integrity impacts rather than C:N/I:L, and this discrepancy should be verified directly against the vendor advisory at the referenced CSAF URL. The Adjacent attack vector (AV:A) is appropriate and represents the most meaningful constraint - exploitation requires controlling a host already listed in the trusted proxy network, which limits opportunistic mass exploitation from the public internet. No EPSS score was provided; KEV status is absent (not listed in CISA KEV); and no public exploit code is known, all of which suggest low immediate exploitation likelihood. The additional passdb configuration requirement further narrows the realistic affected population: only deployments that have both configured trusted proxies and a password-bypass-capable passdb field are vulnerable. That said, hosted mail environments and multi-tenant IMAP deployments - which commonly sit behind proxy tiers - face disproportionate risk if any proxy host is compromised, since the consequence is unrestricted access to every user's mailbox. No data conflicts with KEV or POC status are present, but the CVSS impact metrics conflict with the described capability and should not be used as the sole risk signal.

An attacker who controls or has compromised a host listed in Dovecot's login_trusted_networks sends a crafted IMAP authentication request containing a forged internal authentication field to the Dovecot server. Because Dovecot does not isolate proxy-forwarded fields from its internal namespace, the field is accepted as a trusted internal signal and Dovecot authenticates the session as an arbitrary target user - granting full mailbox access - with no password required. No public exploit code is known at time of analysis, but the attack requires only knowledge of Dovecot's internal authentication field names and network access from the trusted proxy host.