Description
Mailpit is an email testing tool and API for developers. Prior to version 1.28.3, Mailpit's SMTP server is vulnerable to Header Injection due to an insufficient Regular Expression used to validate `RCPT TO` and `MAIL FROM` addresses. An attacker can inject arbitrary SMTP headers (or corrupt existing ones) by including carriage return characters (`\r`) in the email address. This header injection occurs because the regex intended to filter control characters fails to exclude `\r` and `\n` when used inside a character class. Version 1.28.3 fixes this issue.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| axllent | mailpit | < 1.28.3 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 16.0 | govulncheck-vulndb | 0.0.20260723T184607-160000.1.1 | openSUSE-SU-2026:21483-1 |
| openSUSE Leap 15.6 | govulncheck-vulndb | 0.0.20260205T172317-150000.1.146.1 | SUSE-SU-2026:0403-1 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 2 repositories
-
SimoesCTT/-CVE-2026-23829-CTT-Mailpit-phase-reconstruction- ★ 0 · Feb 19, 2026
It's a CRLF injection in Mailpit's SMTP server — a classic data corruption vulnerability. But under CTT, it's not just a bug. It's a phase reconstruction opportunity.
-
SimoesCTT/CTT-Mailpit-RCE-v1.0---Temporal-Resonance-Mail-Server-Takeover ★ 0 · Jan 28, 2026
FROM HEADER INJECTION TO FULL RCE DOMINANCE The Original Flaw (CVE-2026-23829) · CVSS: 6.1/10 (Medium) - Header injection via regex bypass · Impact: Email spoofing, limited header manipulation · Real…
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- Mailpit < 1.28.2 - SMTP CRLF Injection network/cves/2026/CVE-2026-23829.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/axllent/mailpit | < 1.28.3 | 1.28.3 | GHSA-54wq-72mp-cq7c |
Advisories 3
- openSUSE-SU-2026:21483-1 Security update for govulncheck-vulndb SUSE / openSUSE Security Updates · Jul 31, 2026
- SUSE-SU-2026:0403-1 Security update for govulncheck-vulndb SUSE / openSUSE Security Updates · Mar 23, 2026
- WID-SEC-2026-0146 MailPit: Mehrere Schwachstellen BSI CERT-Bund (WID) · Feb 8, 2026