CVE-2026-22689

Summary
The Mailpit WebSocket server is configured to accept connections from any origin. This lack of Origin header validation introduces a Cross-Site WebSocket Hijacking (CSWSH) vulnerability.

An attacker can host a malicious website that, when visited by a developer running Mailpit locally, establishes a WebSocket connection to the victim's Mailpit instance (default ws://localhost:8025). This allows the attacker to intercept sensitive data such as email contents, headers, and server statistics in real-time.

Vulnerable Code
The vulnerability exists in server/websockets/client.go where the CheckOrigin function is explicitly set to return true for all requests, bypassing standard Same-Origin Policy (SOP) protections provided by the gorilla/websocket library.

https://github.com/axllent/mailpit/blob/877a9159ceeaf380d5bb0e1d84017b24d2e7b361/server/websockets/client.go#L34-L39

Impact
This vulnerability impacts the Confidentiality of the data stored in or processed by Mailpit.
Although Mailpit is often used as a local development tool, this vulnerability allows remote exploitation via a web browser.

• Scenario: A developer has Mailpit running at localhost:8025.
• Trigger: The developer visits a malicious website (or a compromised legitimate site) in the same browser.
• Exploitation: The malicious site's JavaScript initiates a WebSocket connection to ws://localhost:8025/api/events. Since the origin check is disabled, the browser allows this cross-origin connection.
• Data Leak: The attacker receives all broadcasted events, including full email details (subjects, sender/receiver info) and server metrics.

Attack Impact

• Real-time notification of new emails
• Email metadata (sender, subject, recipients)
• Mailbox statistics
• All WebSocket broadcast data

Recommended Fix
The CheckOrigin function should be removed to allow gorilla/websocket to enforce its default safe behavior (checking that the Origin matches the Host). Alternatively, strict validation logic should be implemented.

Proposed Change (Remove unsafe check):

var upgrader = websocket.Upgrader{
    ReadBufferSize:    1024,
    WriteBufferSize:   1024,
    // CheckOrigin: func(r *http.Request) bool { return true }, // REMOVED
    EnableCompression: true,
}

Proof of Concept (PoC): To reproduce this vulnerability:

• Start Mailpit (default settings).
• Save the following HTML code as poc.html and serve it from a different origin (e.g., using python http.server on port 8000 or opening it directly as a file).
• Open the poc_websocket_hijack.html file in your browser.
• Send a test email to Mailpit or perform any action in the Mailpit UI.
• Observe that the "malicious" page successfully receives the event data.

CVE-2026-22689 has a CVSS score of 6.5 (Medium). The vector is network-reachable, no privileges required, and user interaction required. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (1.28.2, 0.0.0-20260110031614); upgrading removes the vulnerable code path.

Kodem intelligence

1. What is CVE-2026-22689? CVE-2026-22689 is a medium-severity security vulnerability in github.com/axllent/mailpit (go), affecting versions >= 1.2.6, < 1.28.2. It is fixed in 1.28.2, 0.0.0-20260110031614.
2. How severe is CVE-2026-22689? CVE-2026-22689 has a CVSS score of 6.5 (Medium). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
3. Which versions of github.com/axllent/mailpit are affected by CVE-2026-22689? github.com/axllent/mailpit (go) versions >= 1.2.6, < 1.28.2 is affected.
4. Is there a fix for CVE-2026-22689? Yes. CVE-2026-22689 is fixed in 1.28.2, 0.0.0-20260110031614. Upgrade to this version or later.
5. Is CVE-2026-22689 exploitable, and should I be worried? Whether CVE-2026-22689 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
6. What actually determines whether CVE-2026-22689 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
7. How do I fix CVE-2026-22689?
   • Upgrade github.com/axllent/mailpit to 1.28.2 or later
   • Upgrade github.com/axllent/mailpit to 0.0.0-20260110031614 or later