CVE-2026-45709

Name of the Vulnerable Software and Affected Versions mailpit versions prior to v1.28.3 mailpit versions v1.28.3 and later

Description An incomplete fix for a previous issue allows a Server-Side Request Forgery (SSRF) via the HTML Check API. While previous updates added size limits and content-type checks, the implementation failed to include an IP-filtering dialer. This allows the server to make requests to loopback, private, link-local (including cloud IMDS), and CGNAT addresses, provided the target responds with a text/css content-type and an HTTP 200 status. An attacker can trigger this by sending an HTML email containing a link to a malicious site that redirects the request to an internal network address. In default deployments without UI or SMTP authentication, this is an unauthenticated, network-reachable issue triggered via the /api/v1/message/{id}/html-check endpoint. The vulnerability exists within the newSafeHTTPClient() function in internal/htmlcheck/css.go, which lacks the safeDialContext protection used in other parts of the codebase. This can be exploited to perform state-changing internal GET requests, conduct internal port scanning via timing, or confirm the reachability of cloud IMDS.

Recommendations For versions prior to v1.28.3, update to a version that fully implements the IP-filtering dialer. For versions v1.28.3 and later, update to a version that replaces the newSafeHTTPClient() function with a hardened implementation using safeDialContext to block internal IP addresses. As a temporary mitigation, restrict network access to the mailpit instance to prevent it from reaching internal private networks or cloud metadata services.