Exploitation ongoing with high activity in latest observed window (2 mentions)
Recommended action window: Immediate (within 24h)
NVD description
Mailpit is an email testing tool and API for developers. Versions 1.28.0 and below have a Server-Side Request Forgery (SSRF) vulnerability in the /proxy endpoint, allowing attackers to make requests to internal network resources. The /proxy endpoint validates http:// and https:// schemes, but it does not block internal IP addresses, enabling attackers to access internal services and APIs. This vulnerability is limited to HTTP GET requests with minimal headers. The issue is fixed in version 1.28.1.
Priority
LOW
Exploitation
ACTIVE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
NØX Echo Lineage Signal: CVE-2026-21859 Entity: mailpit Lineage: Public vulnerability → Observed exploitation Relationship: - mailpit → CVE-2026-21859 → Evidence → Operational Risk Current State: DISCLOSED, ACTIVE_EXPLOITATION Watch: - New infrastructure
Another pre-disclosure exploit attempt: CVE-2026-21859 was a Mailpit SSRF disclosed on 1/7/2026. We detected one on 1/4/2026. https://t.co/7AZlQOyvbc
Post summary
The tweet reports that CVE-2026-21859, a Mailpit SSRF, was actively exploited on 1/4/2026, with the detection noted in a linked tweet but no patch or PoC provided.
🚨 This week’s CrowdSec Threat Alert: CVE-2026-21859, a critical SSRF vulnerability in Mailpit, is being actively exploited to map internal networks and access sensitive infrastructure. See how the exploit works, what targeted reconnaissance reveals, and why exposed dev tools can become high-impact entry points in our latest article 👉 https://www.crowdsec.net/vulntracking-report/cve-2026-21859 #CVE #CVE202621859 #threatalert #cybersecurity
Post summary
CVE-2026-21859 is a critical SSRF flaw in Mailpit that is currently being exploited in the wild to map internal networks and access sensitive infrastructure, as reported by CrowdSec.
NØØT Security Alerts Classification: Critical CVE: CVE-2026-21859 Product: axllent / mailpit Summary: VulnCheck reports real-world exploitation activity affecting axllent / mailpit. Evidence: Active exploitation reported; Live exploitation observed by VulnCheck canaries Impact: The vulnerability can materially affect exposed systems; verify vendor-specific impact and affected versions. Action: Prioritize vendor remediation, identify exposed affected systems, and investigate for evidence of exploitation when applicable. Date: 11 Feb 2026 Source: https://vulncheck.com/ #NØØT #CyberSecurity #InfoSec #ThreatIntelligence #CyberThreats #CVE #CyberDefense #mailpit #CVE_2026_21859 #ActiveExploitation #Exploit
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | axllent | mailpit | - | - | - |