CVE-2026-27851

Severity: critical (CVSS 9.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-05-12 · updated 2026-10-26
Weakness: CWE-235

Description

When safe filter is used with variable expansion, all following pipelines on the same string are incorrectly interpreted as safe too, enabling unsafe data to be unescaped. This can enable SQL / LDAP injection attacks when used in authentication. Avoid using safe filter until on fixed version. No publicly available exploits are known.

Affected products

dovecot: before 2.4.4 — fixed in 2.4.4
Open-Xchange Dovecot: before 3.1.5 — fixed in 3.1.5

How to fix

Upgrade to a fixed version: dovecot 2.4.4; Open-Xchange Dovecot 3.1.5. Check the vendor advisory for mitigations.

References

https://documentation.open-xchange.com/dovecot/security/advisories/csaf/2026/oxdc-adv-2026-0002.json
https://access.redhat.com/security/cve/CVE-2026-27851
https://bugzilla.redhat.com/show_bug.cgi?id=2476471
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-27851.json

Get alerted when CVE-2026-27851 or the next vulnerability affects your stack