What’s Vulnerable › Vulnerabilities

CVE-2026-22689: Mailpit is vulnerable to Cross-Site WebSocket Hijacking (CSWSH) allowing unauthenticated access to emails

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-01-10 · updated 2026-06-17
• Weakness: CWE-1385

Description

Mailpit is an email testing tool and API for developers. Prior to version 1.28.2, the Mailpit WebSocket server is configured to accept connections from any origin. This lack of Origin header validation introduces a Cross-Site WebSocket Hijacking (CSWSH) vulnerability. An attacker can host a malicious website that, when visited by a developer running Mailpit locally, establishes a WebSocket connection to the victim's Mailpit instance (default ws://localhost:8025). This allows the attacker to intercept sensitive data such as email contents, headers, and server statistics in real-time. This issue has been patched in version 1.28.2.

Affected products

• axllent mailpit: before 1.28.2 — fixed in 1.28.2

How to fix

Upgrade to a fixed version: axllent mailpit 1.28.2. Check the vendor advisory for mitigations.

References

• https://github.com/axllent/mailpit/commit/6f1f4f34c98989fd873261018fb73830b30aec3f
• https://github.com/axllent/mailpit/security/advisories/GHSA-524m-q5m7-79mm

Get alerted when CVE-2026-22689 or the next vulnerability affects your stack