CVE-2026-86009
8.2HighPublished 16 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- High
- User interaction
- None
- Impact
- High impact on integrity
- Weakness
- CWE-285, CWE-863
Impact
A malicious domain administrator can enable spoofing on hosted domains they do not own and send DKIM/SPF-authenticated emails as those domains. They need administrative access over at least one domain on the shared Mailu instance.
Root cause
Improper authorization checks allow domain managers to toggle spoofing settings on arbitrary hosted domains outside their control.
Affected systems
Mailu Docker images prior to commit f05aeb8322e2f61096af6b089d61ba6f40587d96.
CVSS v4.0 · CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Fix & remediation
Upgrade Mailu Docker images to a release containing commit f05aeb8322e2f61096af6b089d61ba6f40587d96. As an interim workaround, audit existing domain administrator accounts and revoke privileges for untrusted managers.
$ docker compose pull && docker compose up -dAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Mailu is a mail server distributed as a set of Docker images. Prior to f05aeb8322e2f61096af6b089d61ba6f40587d96, domain managers can enable spoofing for hosted domains they do not control. A potentially malicious domain administrator enables spoofing for another hosted domain and can send emails that are authenticated with DKIM/SPF for domains they should not be able to. This vulnerability is addressed by f05aeb8322e2f61096af6b089d61ba6f40587d96.