CVE-2026-0394

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-03-27 · updated 2026-10-26
Weakness: CWE-22

Description

When dovecot has been configured to use per-domain passwd files, and they are placed one path component above /etc, or slash has been added to allowed characters, path traversal can happen if the domain component is directory partial. This allows inadvertently reading /etc/passwd (or some other path which ends with passwd). If this file contains passwords, it can be used to authenticate wrongly, or if this is userdb, it can unexpectly make system users appear valid users. Upgrade to fixed version, or use different authentication scheme that does not rely on paths. Alternatively you can also ensure that the per-domain passwd files are in some other location, such as /etc/dovecot/auth/%d. No publicly available exploits are known.

Affected products

dovecot: before 2.4.0 — fixed in 2.4.0
Open-Xchange Dovecot: before 3.1.0 — fixed in 3.1.0

How to fix

Upgrade to a fixed version: dovecot 2.4.0; Open-Xchange Dovecot 3.1.0. Check the vendor advisory for mitigations.

References

https://documentation.open-xchange.com/dovecot/security/advisories/csaf/2026/oxdc-adv-2026-0001.json

Get alerted when CVE-2026-0394 or the next vulnerability affects your stack