CVE-2026-23829Disclosure(axllent / mailpit)

LOWCVSS 5.3 · MEDIUM

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft
Track advisory updates for patch or workaround availability

Recommended action window: High priority (within 72h)

NVD description

Mailpit is an email testing tool and API for developers. Prior to version 1.28.3, Mailpit's SMTP server is vulnerable to Header Injection due to an insufficient Regular Expression used to validate `RCPT TO` and `MAIL FROM` addresses. An attacker can inject arbitrary SMTP headers (or corrupt existing ones) by including carriage return characters (`\r`) in the email address. This header injection occurs because the regex intended to filter control characters fails to exclude `\r` and `\n` when used inside a character class. Version 1.28.3 fixes this issue.

axllent CVEs Back to dashboard

1.5/ 10 priority

Sources & remediation

Patch / fix

https://github.com/axllent/mailpit/commit/36cc06c125954dec6673219dafa084e13cc14534

Exploit / PoC references

https://github.com/axllent/mailpit/security/advisories/GHSA-54wq-72mp-cq7c

Other references

https://github.com/axllent/mailpit/releases/tag/v1.28.3

Weakness type (CWE)

CWE-93CWE-150

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

mailpit

Threat summary

Public PoC is present in monitored signal
1 mentions across 1 observed day

What's happening

PoC mentioned or linked in 1 signal
Technical details provided in 1 signal
Disclosure: 1 classified signal
1 total mentions across 1 day

Affected systems

Vendors

axllent

Products

mailpit

Deep dive

Activity timeline1 mentions / 1d

Signal classification1 categories

Disclosure

1100.0%

Referenced assets1 URL

By indicator

https://cloud.projectdiscovery.io/library/CVE-2026-23829

Full discourse1 post

pdnuclei-bot@pdnuclei_bot210d
Disclosure
🚨 CVE-2026-23829 - medium 🚨 Mailpit < 1.28.2 - SMTP CRLF Injection > Mailpit < 1.28 contains a header injection caused by insufficient regex validation of... 👾 https://cloud.projectdiscovery.io/library/CVE-2026-23829 @pdnuclei #NucleiTemplates #cve
Post summary
The tweet announces the discovery of CVE-2026-23829, a medium‑severity SMTP CRLF/ header injection issue in Mailpit versions below 1.28.2, and directs readers to a library page and Nuclei template for further details.
00031165
901 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	axllent	mailpit	-	-	-

Explore more

Back to dashboard axllent CVEs mailpit vulnerabilities