CVE-2026-33586: Authenticated SMTP Sender Address Forgery

Severity: medium (CVSS 6.3 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-07 · updated 2026-10-08
Weakness: CWE-290

Description

Authenticated users are able to manipulate both the SMTP envelope “Envelope-from” and “From” fields when sending emails through OVH mail servers. Due to OVH's default SPF configuration, which commonly includes include:mx.ovh.com, any authenticated user with a valid OVH email account can send messages that appear to originate from any OVH-hosted domains using the default SPF record. Since the SPF policy explicitly authorizes OVH mail servers (mx.ovh.com) to send mail on behalf of these domains, forged messages successfully pass SPF validation despite not being authorized by the impersonated domain owner.

Affected products

OVHcloud: before 2026-07-20 — fixed in 2026-07-20

How to fix

Upgrade to a fixed version: OVHcloud 2026-07-20. Check the vendor advisory for mitigations.

References

https://docs.ovhcloud.com/en/guides/web-cloud/email-and-collaborative-solutions/troubleshooting/email-rejected-cross-domain-spoofing

Get alerted when CVE-2026-33586 or the next vulnerability affects your stack