CVE-2026-114474

Use of a less trusted source for the envelope sender in the external-account download of Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a remote unauthenticated attacker to have mail they write in the name of a domain the server hosts sent on by the server with an envelope sender at that domain, so that it passes the domain's SPF and DMARC at other receivers. A message the server downloads from an external POP3 or IMAP account has no SMTP envelope of its own, and the server took the address in its From header as its envelope sender, whatever that address was. A forward or redirect of the downloaded message to an outside address then left with that address as its envelope sender, which the Sender Rewriting Scheme leaves alone for a hosted domain, so that the receiver's SPF check passed for the forged domain, aligned even under strict alignment, with no non-default setting, host name record or DMARC policy needed. An attacker needs to know a mailbox elsewhere that an account here collects and forwards to an outside address; an account holder who adds an external account of their own can collect from a server of their own, which matters where SmtpAuthenticatedSenderCheck holds signed-in senders to their own addresses.

• CWE-348

• https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.7
• https://gitlab.com/hmailserver/hmailserver/-/work_items/91

Published

Oct 21, 2026

Last Modified

Oct 29, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-114463The webhook platform gateway in Nous Research Hermes Agent v…7.5
• CVE-2026-11447A security flaw has been discovered in GL.iNet GL-MT3000 up …6.3
• CVE-2026-114470Cross-site request forgery in the REST API of Progressive Ro…5.3
• CVE-2026-114471Insertion of sensitive information into a log file in the SM…4.7
• CVE-2026-114472Insufficient resource pool in the ACME HTTP-01 challenge res…3.7
• CVE-2026-114473Incorrect authorization in the Sender Rewriting Scheme (SRS)…5
• CVE-2026-114475Missing authorization in the REST role-management routes of …6.5
• CVE-2026-114476Incorrect authorization in the REST administration API of Pr…7.5
• CVE-2026-114477Missing authorization in the REST metrics route of Progressi…4.3
• CVE-2026-114478Insufficient preservation of the original sender in the forw…5.9
• CVE-2026-114479Not failing securely in the anti-virus attachment-stripping …5.8
• CVE-2026-11448A weakness has been identified in GL.iNet GL-MT3000 up to 4.…5.1