CVE-2026-126611

Progressive Robot hMailServer 6.3.4 through 6.3.7, with a MySQL or MariaDB database, TlsMode=verify-full and no TlsCaFile, does not verify the database server's certificate's issuer or name when the connection is one that MariaDB Connector/C treats as local - Server= set to 127.0.0.1, ::1 or localhost (on Linux a Unix socket), to . on Windows (a named pipe), or to a comma-separated list of servers that holds such an element - which allows a local attacker who can stand in for the database server, for example by listening on its port while it is stopped or restarting, to receive the database sign-in, the password included, and to read and modify the traffic between hMailServer and its database. hMailServer applied verify-full by turning the client's certificate verification on without a CA file, but MariaDB Connector/C 3.4.1 and later, on a connection they treat as local and with no CA file, accept any certificate within its validity period that is self-signed or sent with its own root, for any name (Connector/C 3.4.2 to 3.4.10 also one whose issuer they cannot find), so the client accepted the certificate an impostor made, asked no proof of the password and allowed a switch to an authentication method that sends the password unhashed, while hmailserver --check-database said the certificate had been checked against the system's trust store and the application log that it had been checked. The Windows builds bundle Connector/C 3.4.9 (6.3.4 to 6.3.6) and 3.4.11 (6.3.7); on Linux the distribution's client is used, and Connector/C 3.3 and 3.4.0 and Oracle's MySQL client are not affected. The configuration is not the default: TlsMode defaults to prefer, which checks no certificate.

• CWE-295

• https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.8
• https://gitlab.com/hmailserver/hmailserver/-/work_items/113

Published

Nov 11, 2026

Last Modified

Nov 12, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-1266The Postalicious plugin for WordPress is vulnerable to Store…4.4
• CVE-2026-12660IBM MQ Web Console could allow an authenticated administrato…2.7
• CVE-2026-126607Progressive Robot hMailServer 6.2.3 through 6.3.7 on Windows…7.8
• CVE-2026-126609Progressive Robot hMailServer 6.2.25 through 6.3.7 on Window…7.5
• CVE-2026-12661A denial-of-service security issue exists within FactoryTalk…4.8
• CVE-2026-126610Progressive Robot hMailServer 6.3.4 through 6.3.7, with a My…7.4
• CVE-2026-126612Improper link resolution in the Windows installer of Progres…7.8
• CVE-2026-126613Allocation of resources without limits in the JSON reader of…7.5
• CVE-2026-126614The web services listener of Progressive Robot hMailServer 6…5.3
• CVE-2026-126615The sign-in of Progressive Robot hMailServer 6.2.22-pre2 thr…5.3
• CVE-2026-126616The auto-ban of Progressive Robot hMailServer 6.2.0 through …5.3
• CVE-2026-126617SQL injection in the database layer of Progressive Robot hMa…8.8