CVE-2026-27808

Mailpit is an email testing tool and API for developers. Prior to version 1.29.2, the Link Check API (/api/v1/message/{ID}/link-check) is vulnerable to Server-Side Request Forgery (SSRF). The server performs HTTP HEAD requests to every URL found in an email without validating target hosts or filtering private/internal IP addresses. The response returns status codes and status text per link, making this a non-blind SSRF. In the default configuration (no authentication on SMTP or API), this is fully exploitable remotely with zero user interaction. This is the same class of vulnerability that was fixed in the HTML Check API (CVE-2026-23845 / GHSA-6jxm-fv7w-rw5j) and the screenshot proxy (CVE-2026-21859 / GHSA-8v65-47jx-7mfr), but the Link Check code path was not included in either fix. Version 1.29.2 fixes this vulnerability.

• CWE-918

• https://github.com/axllent/mailpit/commit/10ad4df8cc0cd9e51dea1b4410009545eef7fbf5Patch
• https://github.com/axllent/mailpit/releases/tag/v1.29.2Release Notes
• https://github.com/axllent/mailpit/security/advisories/GHSA-mpf7-p9x7-96r3Exploit, Vendor Advisory
• https://github.com/axllent/mailpit/security/advisories/GHSA-mpf7-p9x7-96r3Exploit, Vendor Advisory

Published

Feb 26, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-27801Vaultwarden is an unofficial Bitwarden compatible server wri…5.9
• CVE-2026-27802Vaultwarden is an unofficial Bitwarden compatible server wri…8.3
• CVE-2026-27803Vaultwarden is an unofficial Bitwarden compatible server wri…8.3
• CVE-2026-27804Parse Server is an open source backend that can be deployed …9.1
• CVE-2026-27806Fleet is open source device management software. Prior to 4.…7.8
• CVE-2026-27807MarkUs is a web application for the submission and grading o…4.9
• CVE-2026-27809psd-tools is a Python package for working with Adobe Photosh…9.1
• CVE-2026-2781Integer overflow in the Libraries component in NSS. This vul…9.8
• CVE-2026-27810calibre is a cross-platform e-book manager for viewing, conv…6.4
• CVE-2026-27811Roxy-WI is a web interface for managing Haproxy, Nginx, Apac…8.8
• CVE-2026-27812Sub2API is an AI API gateway platform designed to distribute…9.1
• CVE-2026-27813EVerest is an EV charging software stack. Versions prior to …5.3