EUVD-2026-88759
GHSA-j4qm-pqjf-933v
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach docker-mailbox API without bearer-token auth
-
DeliverySend request with CRLF in folder/UID/search value
-
ExploitInjected line breaks into IMAP command stream
-
ExecutionExecute attacker IMAP commands on authenticated upstream
-
ImpactRead, modify, or delete victim mailbox contents
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization CRLF sequence sanitization
|
| Exploitation Conditions | Exploitable only when bearer-token authentication is NOT configured on the docker-mailbox instance (before version 0.4.13); with bearer-token auth enabled the unauthenticated remote path is closed. The attacker must be able to reach the service's API and supply attacker-controlled folder, UID, or search parameter values that are passed into IMAP command construction; the service must already hold an authenticated upstream mailbox connection for the injected commands to take effect. No user interaction is required. The principal limiting factors are the non-default requirement of running without bearer-token auth and the extremely small deployment base of this niche project. |
| Impact | The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H = 9.4) describes a network-reachable, low-complexity, unauthenticated IMAP command-injection flaw with high integrity and availability impact - on paper a critical issue. However, the raw score must be tempered by two independent signals. First, the unauthenticated path is conditional: it only applies 'when bearer-token authentication is not configured,' so deployments that enable bearer-token auth are not remotely-unauthenticated-exploitable, which the base PR:N does not capture. Second, exploitation status is weak: there is no CISA KEV listing, no EPSS score, and no public exploit identified at time of analysis - the only reference is the vendor's own patch commit. This points to a real but not yet actively-exploited vulnerability. The dominant limiting factor is product footprint: psyb0t/docker-mailbox is an obscure personal GitLab project, so despite the 9.4 score this is a low real-world-priority issue except for the handful of environments actually running it without bearer-token auth. No SSVC data was provided; automatable/exploitation-status fields are inferred only from the CVSS vector and description. |
| Exploit ScenarioDerived | A remote attacker targets a docker-mailbox instance that has been deployed without bearer-token authentication configured, submitting an API request whose folder, UID, or search parameter embeds CRLF (\r\n) sequences. Because these values are inserted unsanitized into IMAP commands sent over the service's already-authenticated upstream mailbox connection, the injected line is executed as an additional IMAP command, letting the attacker read, alter, or delete mail in that mailbox. No public exploit code has been identified; only the vendor fix commit is referenced. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 29, 2026
CRLF injection in psyb0t/docker-mailbox before 0.4.13 allows a remote unauthenticated attacker to append arbitrary IMAP commands to the service's already-authenticated upstream mailbox connection when bearer-token authentication is not configured. Attacker-controlled folder, UID, or search values are passed into IMAP command construction without neutralization, yielding high integrity and availability impact on the mail store; the exposed path only exists on instances deployed without bearer-token auth, and no public exploit has been identified at time of analysis. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects a network-reachable, low-complexity, no-interaction flaw, though real-world risk is constrained by the non-default configuration requirement and the project's very small deployment base.
RemediationAI
Upgrade psyb0t/docker-mailbox to 0.4.13 or later; the upstream fix is identified by commit 90e6b492d42e011d0ba2c825795b33d054ee6636 (https://gitlab.com/psyb0t/docker-mailbox/-/commit/90e6b492d42e011d0ba2c825795b33d054ee6636), and the CVE description identifies 0.4.13 as the first non-vulnerable version, so pin that tag or newer in the container image reference rather than tracking :latest. If an immediate upgrade is not possible, enabling bearer-token authentication is the most direct compensating control because the unauthenticated injection path is closed when bearer-token auth is configured - the trade-off is that every API client must now present a valid token, which can break existing integrations and automation. As a secondary layer, restrict network access to the service's API so only trusted internal hosts can reach the endpoints that accept folder, UID, and search parameters; this reduces exposure but does not fix the underlying neutralization defect and can cut off legitimate remote management. A reverse proxy or WAF rule that rejects request parameters containing CR or LF characters (percent-encoded %0d/%0a as well) provides defense in depth at the cost of potentially rejecting otherwise valid folder or search strings that contain encoded line breaks. Because no public exploit has been identified at time of analysis, prioritization should be driven by whether affected instances are internet-reachable and running without bearer-token auth.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-93 (Improper Neutralization of CRLF Sequences, i.e. CRLF/command injection) in an IMAP client component. IMAP is a line-oriented text protocol in which CRLF terminates each command, so any application that builds IMAP command strings by concatenating untrusted input can be tricked into terminating the intended command early and starting additional attacker-supplied commands. Here the vulnerable construction takes folder names, UIDs, and search expressions from the service's own API surface and splices them into commands issued over a connection to an upstream mail server that the docker-mailbox container has already authenticated to. Because the injected commands ride on that pre-existing authenticated session, they inherit the mailbox credentials held by the service rather than requiring the attacker to authenticate - which is why an unauthenticated remote attacker can still achieve high integrity and availability impact. The single affected CPE, cpe:2.3:a:psyb0t:docker-mailbox:*:*:*:*:*:*:*:*, uses a wildcard version, meaning every release prior to the fixed 0.4.13 is presumed affected. The independent assessment (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) confirms confidentiality, integrity, and availability as high, slightly exceeding the 9.4 published score where confidentiality was rated low; the attacker profile is unauthenticated and remote per the PR:N vector, and no user interaction is required (UI:N).
Know when Docker gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H
Unauthenticated network CRLF injection (PR:N/AV:N/AC:L) in the no-bearer-token mode yields arbitrary IMAP commands on the mailbox, so I raise C to H alongside I:H/A:H.
Primary rating from Vendor (GitLab).
CVSS VectorVendor: GitLab
DescriptionCVE.org
Improper neutralization of CRLF sequences in IMAP command construction in psyb0t/docker-mailbox before 0.4.13 allows a remote unauthenticated attacker, when bearer-token authentication is not configured, to inject additional IMAP commands into an authenticated upstream mailbox connection via crafted folder, UID, or search values.
Articles & Coverage 1
Executive ViewAI
psyb0t/docker-mailbox, a containerized mailbox bridge with a very small deployment footprint, is affected by a CRLF injection flaw (CVE-2026-82973, CVSS 9.4) that allows an unauthenticated network attacker to append arbitrary IMAP commands to the service's already-authenticated upstream mailbox connection, corrupting or destroying mailbox contents. Exposure is limited to instances deployed without bearer-token authentication, so only organizations running that non-default configuration face direct risk, but for those the impact is loss of integrity and availability of stored email. Leadership should care because tampering with business correspondence can disrupt email-dependent workflows and erode trust in retained records.
No vendor-released patch identified at time of analysis (advisory references 0.4.13 as the fixed boundary; confirm with vendor). Interim mitigations: enable bearer-token authentication to eliminate the exposed path, restrict network reachability of the service to trusted segments, rotate upstream mailbox credentials, and monitor IMAP traffic for injected CRLF sequences and anomalous folder or UID activity.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.
An issue was discovered in Appsmith before 1.52. Rated critical severity (CVSS 9.8), this vulnerability is remotely expl
runc through version 1.0-rc6 (used in Docker before 18.09.2) contains a container escape vulnerability that allows attac
Netmaker makes networks with WireGuard. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no a
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
The News & Blog Designer Pack - WordPress Blog Plugin - (Blog Post Grid, Blog Post Slider, Blog Post Carousel, Blog Post
Path traversal in JFrog Artifactory (CWE-22) enables an authenticated low-privilege user to write data outside the inten
Docker 1.3.2 allows remote attackers to execute arbitrary code with root privileges via a crafted (1) image or (2) build
Remote code execution in Gogs through 0.14.2 allows authenticated users (and unauthenticated attackers on default-config
Unauthenticated remote command injection in SGWBOX N3 firmware 2.0.25 lets attackers execute arbitrary operating-system
Remote code execution in Flowise before 3.1.2 allows any authenticated user (or API caller with chatflow view/update per
Remote code execution in NocoBase Workflow Script Node (npm @nocobase/plugin-workflow-javascript) allows authenticated l
Docker Desktop Community Edition before 2.1.0.1 allows local users to gain privileges by placing a Trojan horse docker-c
Exploit-DB