CVE-2026-101281

A flaw has been found in Trusted Domain Project OpenDMARC up to 1.4.2. Affected by this vulnerability is the function opendmarc_sp2_find_mailfrom_domain of the file libopendmarc/opendmarc_spf.c of the component SPF Macro Handler. This manipulation causes improper authentication. The attack is possible to be carried out remotely. The exploit has been published and may be used. Patch name: c48a74c758677fc5272a73eff15ffdbf8afda1a6. Applying a patch is the recommended action to fix this issue.

• CWE-287

• https://github.com/trusteddomainproject/OpenDMARC/commit/c48a74c758677fc5272a73eff15ffdbf8afda1a6
• https://github.com/trusteddomainproject/OpenDMARC/issues/262
• https://github.com/trusteddomainproject/OpenDMARC/pull/328
• https://vuldb.com/cve/CVE-2026-101281
• https://vuldb.com/submit/918284
• https://vuldb.com/vuln/411038
• https://vuldb.com/vuln/411038/cti
• https://xuyongzhe-vt.github.io/share/opendmarc-spf-postmaster-macro.html

Published

Sep 29, 2026

Last Modified

Oct 1, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-101276iperf3 3.21 (esnet/iperf) contains a remote, unauthenticated…9.2
• CVE-2026-101277A security flaw has been discovered in Trusted Domain Projec…6.5
• CVE-2026-101278A weakness has been identified in Trusted Domain Project Ope…4.3
• CVE-2026-101279A security vulnerability has been detected in Trusted Domain…6.5
• CVE-2026-10128IBM Langflow OSS 1.0.0 through 1.10.3 allows authenticated u…6.5
• CVE-2026-101280A vulnerability was detected in Trusted Domain Project OpenD…7.3
• CVE-2026-101283iperf3 3.20–3.21 (esnet/iperf) has a pre-auth heap buffer ov…9.2
• CVE-2026-101287Authentication bypass vulnerability in Stela, versions prior…9.3
• CVE-2026-101288IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote a…8.8
• CVE-2026-10129IBM Langflow OSS 1.0.0 through 1.9.3 contains a Server-Side …8.5
• CVE-2026-101290A remote attacker may send a specially crafted network packe…7.5
• CVE-2026-101292Apache ActiveMQ Artemis before 2.34.0 contains an unsafe ref…8.2