Mailpit CVE-2026-67448

Exploitation requires all three of the following: (1) a Mailpit instance running version 1.29.0-1.30.5 without --ui-auth-file authentication - the default configuration; (2) the instance must be reachable from the victim's browser, which is satisfied by the default localhost binding when the victim is the developer running Mailpit; and (3) the victim must actively visit an attacker-controlled web page while Mailpit is running. No SMTP credentials, no ability to send or inject mail, and no interaction beyond page load are required on the attacker's side. Exploitation is prevented entirely by the --ui-auth-file flag (confirmed by vendor advisory). Exploitation is also structurally limited to read-only information disclosure - the attacker cannot modify mail, alter Mailpit state, or pivot to other systems. The attack targets developers, not end users or production environments, narrowing realistic exposure.

The CVSS 6.5 score (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) accurately reflects the attack surface: network-reachable and unauthenticated, but requiring the victim to visit an attacker-controlled page, with high confidentiality impact and no integrity or availability effects. Real-world risk is bounded by Mailpit's deployment profile - it is a developer-facing tool typically bound to localhost, so production PII is rarely at stake and the attack surface is limited to the developer's own machine during an active session. The GHSA advisory confirms a working proof of concept with measured reproduction, meaning the barrier to exploitation is low for anyone who knows the technique; however, no CISA KEV listing and no EPSS data were provided, so widespread automated exploitation is not confirmed. The most credible threat is a malicious npm dependency or phishing page visited while a developer has a Mailpit instance running locally. Instances protected by --ui-auth-file are explicitly immune, which substantially reduces effective exposure for teams that follow the authentication guidance.

A developer runs Mailpit v1.29.0-1.30.5 locally in default configuration (no --ui-auth-file) and visits a malicious webpage - perhaps embedded in a compromised npm package's postinstall script or a phishing link. The page opens a JavaScript WebSocket to http://localhost:8025/%61pi/events; the raw-URI origin check is bypassed, Go's ServeMux routes the decoded path to /api/events, and the upgrader accepts the connection. For every email processed by Mailpit while the socket is open, the attacker receives the message ID, Message-Id header, sender, recipients, subject line, tags, and body snippet in real time. A working proof of concept demonstrating this full flow is documented in GHSA-8r62-w5wh-fc5m.