CVE-2026-107567

Use of a less trusted source in the DKIM signing of Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a remote unauthenticated attacker to have mail they write signed with the DKIM key of a domain the server hosts, so that it passes DKIM and DMARC for that domain at other receivers. With DKIM signing enabled for a hosted domain, the server signed every message on its first delivery pass as the domain named in its From header, before local delivery, whatever the message's origin and without checking that its sender had authenticated. A sender anywhere could therefore send the server, as ordinary inbound mail, a message whose From is any address at such a domain, and the server signed it with that domain's key. Every copy the server then sent on to an address outside carried a valid signature aligned with the forged From, whatever the domain's DMARC policy: an account's forward, a mail rule's forward or copy, a Sieve redirect, an alias or distribution list with an outside member, the mirror copy, a managed-list or journal copy, or a message released from quarantine. A signed copy can also be re-sent to other recipients while the domain's key is unchanged. Exploitation needs DKIM signing to be enabled for the hosted domain (it is off until configured) and, for the forgery to leave the server, a forward, alias, list or rule that carries the domain's mail to an outside address. The signer likewise signed a message submitted over authenticated SMTP as whatever hosted domain its From header named, a header authenticated SMTP does not hold to the submitting account, so that an account of one hosted domain could have mail written in the name of another hosted domain signed with that domain's key; this mattered where the server holds signed-in senders to their own envelope addresses (SmtpAuthenticatedSenderCheck, off by default), as the signature was then the remaining way for such mail to pass the other domain's DMARC policy.

• CWE-348

• https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.7
• https://gitlab.com/hmailserver/hmailserver/-/work_items/84

Published

Oct 19, 2026

Last Modified

Oct 20, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-10754Pega Platform versions 8.5.0 through 25.1.2 are affected by …8.6
• CVE-2026-10755The All in One SEO WordPress plugin before 4.9.9 does not c…2.7
• CVE-2026-10756TRO600 contains a vulnerability that allows an authenticated…7.7
• CVE-2026-107564An unauthenticated remote attacker may use an allocation of …7.5
• CVE-2026-107565A flaw was found in luksmeta. A local attacker with administ…5.1
• CVE-2026-107566Missing authorization in the Sieve editheader action (6.2.22…6.5
• CVE-2026-107568Missing authorization in the Sieve notify action (6.2.22 thr…6.5
• CVE-2026-107569Unchecked input for a loop condition in Progressive Robot hM…7.5
• CVE-2026-10757There is a SQL injection vulnerability in Esri ArcGIS Server…9.8
• CVE-2026-107570heap OOB write in convert_file_from_to() via a crafted Conte…2.5
• CVE-2026-107571Incorrect default permissions in the Windows installer of Pr…7.8
• CVE-2026-107572Inefficient complexity in the Sieve filter evaluation of Pro…6.5