CVE-2026-42008

Name of the Vulnerable Software and Affected Versions Dovecot (affected versions not specified)

Description Information forwarded from a host configured as a trusted proxy is not properly isolated from internal authentication fields. This allows a trusted proxy to inject values into internal authentication fields, enabling any host with trusted proxy status to authenticate as any user without providing a password. This issue specifically impacts deployments where the password database recognizes fields that allow passwordless authentication.

Recommendations Update to a non-vulnerable version. Restrict the list of trusted proxy networks to only include hosts that are fully under your control.