CVE-2026-85751Disclosure

LOWCVSS 9.8 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Mailu is a mail server distributed as a set of Docker images. From Mailu 2.0 until 2024.06.55 and prior to Mailu helm-charts 2.7.3, deployments with PROXY_AUTH_WHITELIST configured but REAL_IP_HEADER unset trusted a client-controlled X-Forwarded-By header for header-based proxy authentication. The proxy_hide_header directive in the nginx template at core/nginx/conf/proxy.conf hid the header from upstream responses but did not overwrite the incoming request value in this configuration. An unauthenticated remote attacker could therefore spoof the trusted proxy identity and bypass authentication. This issue is fixed in Mailu 2024.06.55 and Mailu helm-charts 2.7.3.

Back to dashboard

0.5/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-290CWE-807

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

Patch or workaround signal is available
7 mentions across 3 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 3 signals
Technical details provided in 6 signals
Disclosure: 3 classified signals
General: 1 classified signal
Peaked 2d ago at 5 mentions (2026-09-22); latest day: 1
7 total mentions across 3 days

Deep dive

Activity timeline7 mentions / 3d

Signal classification3 categories

Disclosure

342.9%

Patch

342.9%

General

114.3%

Referenced assets5 URLs

By indicator

Classification over time

Date	Total	Labels

2026-09-22	5	Disclosure2General1Patch2
2026-09-23	1	Disclosure1
2026-10-12	1	Patch1

Full discourse7 posts

Hugo | DevOps | Cybersecurity 🇱🇻@HugoValters26d
Patch
CVE-2026-85751: Mailu auth bypass, unauthenticated proxy header spoofing, CVSS 9.8. Patch under review. Pin config or upgrade now. https://www.valtersit.com/cve/CVE-2026-85751 #CVE #infosec #Mailu #Mailu #CVEALERT #CVE #infosec #Linux #XSS #valtersit #snippet #SysAdmin #cybersecurity #devsecops #devops #developer #100daysofcode #git #github #gitlab #redteam #blueteam #ethicalhacker #cybersecurityawareness #cybersecuritynews #cybersecuritytips #python #hacker #kali #ubuntu #debian #docker
Post summary
The tweet announces CVE-2026-85751 affecting Mailu with an auth bypass and proxy header spoofing vulnerability (CVSS 9.8), notes a patch is under review, and urges users to pin configuration or upgrade immediately.
0101048
1.1K followersView on X
Rıdvan Yağlı@ridvanyagli46d
Patch
Mailu'da CVE-2026-85751 | CVSS 9.8 Kritik Güvenlik Açığı! Mailu 2.0.0–2024.06.54 sürümlerinde, PROXY_AUTH_WHITELIST yapılandırılmış ancak REAL_IP_HEADER tanımlanmamışsa istemci tarafından spoof edilebilen X-Forwarded-By header'ı üzerinden kimlik doğrulama atlatılabiliyor. 🔴 Uzaktan, kimlik doğrulama gerektirmiyor. ✅ Bu açık, Mailu 2024.06.55 / Helm Charts 2.7.3 ile yamalandı.
Post summary
The text discloses a critical authentication bypass vulnerability (CVE-2026-85751) in Mailu and explicitly states that it has been remediated in versions 2024.06.55 and Helm Charts 2.7.3.
00020500
2.5K followersView on X
Cyber Threat Observatory | Alan Turing Institute@TuringCyberObs45d
Disclosure
CVE-2026-85751 Mailu Proxy-header trust flaws could let unauthenticated attackers bypass webmail or admin authentication in affected Mailu deployments Full analysis: https://github.com/alan-turing-institute/cyber-threat-observatory/blob/main/reports/2026-09-21/TIER_2_CVE-2026-85751.md #CyberSecurity #EmailSecurity #VulnerabilityManagement
Post summary
The tweet announces CVE‑2026‑85751 in Mailu, describing a proxy‑header trust flaw that lets unauthenticated attackers bypass authentication, and links to a detailed analysis; no PoC, exploit, active exploitation, or patch is mentioned.
0001061
63 followersView on X
ExploitGrid@exploitgrid46d
Disclosure
[CVE] CVE-2026-85751 [HIGH PRIORITY] #Mailu: Authentication bypass in header-based proxy authentication via spoofab... 🔗 https://exploitgrid.net/cve/CVE-2026-85751
Post summary
The text discloses CVE-2026-85751 as a high-priority authentication bypass vulnerability in Mailu's header-based proxy authentication via spoofing, providing a link for further details without mentioning patches, exploits, or active exploitation.
1000040
203 followersView on X
ExploitGrid@exploitgrid46d
General
🛡️ #ExploitGrid Daily #Threat Digest Top Vulnerabilities (CVEs) of the day CVE-2026-77521 CVE-2026-79920 CVE-2026-82187 CVE-2026-85751 CVE-2026-94301 ..🧵👇
Post summary
The text is a threat digest listing five CVE IDs without technical details, exploit links, or remediation information, fitting the General classification.
1000055
203 followersView on X
VulnTracker@vuln_tracker46d
Patch
A single spoofed header can bypass Mailu's proxy authentication entirely (CVSS 9.8). CVE-2026-85751 hits deployments where PROXY_AUTH_WHITELIST is set but REAL_IP_HEADER isn't. Mailu trusts a client-controlled X-Forwarded-By header, so an unauthenticated attacker can spoof the trusted proxy and walk straight past login. Affects Mailu 2.0 through 2024.06.55 and helm-charts before 2.7.3. Fixed in Mailu 2024.06.55 and helm-charts 2.7.3. Details: http://vulntracker.io/cves/CVE-2026-85751 #Mailu #CVE #InfoSec #CyberSecurity #AuthBypass
Post summary
The post describes an authentication bypass in Mailu caused by trusting a client-controlled X-Forwarded-By header, affecting versions up to 2024.06.55, and notes that the flaw is fixed in Mailu 2024.06.55 and helm-charts 2.7.3.
00000113
781 followersView on X
Cybersecurity News DE@cybsecuritynews46d
Disclosure
#schwachstellen Mailu-Lücke CVE-2026-85751 erlaubt Authentifizierungs-Bypass in Docker-Mailservern #cve202685751 #docker #helm #mailu #nginx https://cybersecurity-news.de/mailu-cve-2026-85751-authentifizierungs-bypass
Post summary
The text announces CVE-2026-85751, detailing an authentication bypass vulnerability in Docker-based Mailu mail servers, but does not mention a PoC, exploit tool, active exploitation, or available patches.
0000027
13 followersView on X

Explore more

Back to dashboard

What researchers are saying

CVE-2026-85751

Hugo | DevOps | Cybersecurity 🇱🇻[verified]@HugoValtersPatch

The tweet announces CVE-2026-85751 affecting Mailu with an auth bypass and proxy header spoofing vulnerability (CVSS 9.8), notes a patch is under review, and urges users to pin configuration or upgrade immediately.

Rıdvan Yağlı[verified]@ridvanyagliPatch

The text discloses a critical authentication bypass vulnerability (CVE-2026-85751) in Mailu and explicitly states that it has been remediated in versions 2024.06.55 and Helm Charts 2.7.3.

VulnTracker[verified]@vuln_trackerPatch

The post describes an authentication bypass in Mailu caused by trusting a client-controlled X-Forwarded-By header, affecting versions up to 2024.06.55, and notes that the flaw is fixed in Mailu 2024.06.55 and helm-charts 2.7.3.

Cyber Threat Observatory | Alan Turing Institute@TuringCyberObsDisclosure

The tweet announces CVE‑2026‑85751 in Mailu, describing a proxy‑header trust flaw that lets unauthenticated attackers bypass authentication, and links to a detailed analysis; no PoC, exploit, active exploitation, or patch is mentioned.

ExploitGrid@exploitgridDisclosure

The text discloses CVE-2026-85751 as a high-priority authentication bypass vulnerability in Mailu's header-based proxy authentication via spoofing, providing a link for further details without mentioning patches, exploits, or active exploitation.

ExploitGrid@exploitgridGeneral

The text is a threat digest listing five CVE IDs without technical details, exploit links, or remediation information, fitting the General classification.

Cybersecurity News DE@cybsecuritynewsDisclosure

The text announces CVE-2026-85751, detailing an authentication bypass vulnerability in Docker-based Mailu mail servers, but does not mention a PoC, exploit tool, active exploitation, or available patches.