CVE-2026-85751

Name of the Vulnerable Software and Affected Versions Mailu versions 2.0 through 2024.06.54 Mailu helm-charts versions prior to 2.7.3

Description Deployments configured with PROXY AUTH WHITELIST but without REAL IP HEADER set trust a client-controlled X-Forwarded-By header for proxy authentication. The proxy hide header directive in the nginx template at core/nginx/conf/proxy.conf hides the header from upstream responses but fails to overwrite the incoming request value. This allows an unauthenticated remote attacker to spoof the trusted proxy identity and bypass authentication.

Recommendations Update Mailu to version 2024.06.55. Update Mailu helm-charts to version 2.7.3.