CVE-2026-40871: high-severity vulnerability in mailcow-dockerized
mailcow: dockerized vulnerable to Second Order SQL Injection in quarantine category via API
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7.2epss 8.6%
mailcow: dockerized is an open source groupware/email suite based on docker. Versions prior to 2026-03b have a second-order SQL injection vulnerability in the quarantine_category field via the Mailcow API. The /api/v1/add/mailbox endpoint stores quarantine_category without validation or sanitization. This value is later used by quarantine_notify.py, which constructs SQL queries using unsafe % string formatting instead of parameterized queries. This results in a delayed (second-order) SQL injection when the quarantine notification job executes, allowing an attacker to inject arbitrary SQL. Using a UNION SELECT, sensitive data (e.g., admin credentials) can be exfiltrated and rendered inside quarantine notification emails. Version 2026-03b fixes the vulnerability.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Affected products
mailcow · mailcow-dockerizedRelated CVEs — mailcow-dockerized
In the same product, most dangerous first.
CVE-2024-30270MEDIUMmailcow Path Traversal and Arbitrary Code Execution VulnerabilityEPSS 27.3%CVE-2024-31204MEDIUMmailcow Cross-site Scripting Vulnerability via Exception HandlerEPSS 8.2%CVE-2022-31138HIGHOS Command Injection in mailcowEPSS 3.3%CVE-2023-26490HIGHmailcow is vulnerable to shell command injection via xoauth2 authentication in imapsyncEPSS 2.2%CVE-2022-39258HIGHmailcow-dockerized critical information misrepresentation can lead to phishing attacks through Swagger UIEPSS 1.8%CVE-2025-25198HIGHmailcow: dockerized vulnerable to password reset poisoningEPSS 1.1%