CVE-2026-24031: SQL Injection
Dovecot SQL based authentication can be bypassed when authusernamechars is cleared by admin. This vulnerability allows bypassing authentication for any user and user enumeration. Do not clear authusernamechars. If this is not possible, install latest fixed version. No publicly available exploits are known.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Ensure Dovecot's SQL-based authentication setting auth_username_chars is NOT cleared by the admin, as clearing it can allow authentication bypass and user enumeration.
Dovecot auth_username_chars = do not clear (do not disable/empty)
Event History
Frequently Asked Questions
What is the severity of CVE-2026-24031?
CVE-2026-24031 is considered a critical vulnerability as it allows unauthorized access and user enumeration.
How do I fix CVE-2026-24031?
To fix CVE-2026-24031, do not clear auth_username_chars, or install the latest fixed version of Dovecot.
What does CVE-2026-24031 affect?
CVE-2026-24031 affects Dovecot SQL-based authentication systems.
Can CVE-2026-24031 be exploited remotely?
While there are no publicly available exploits for CVE-2026-24031, the vulnerability allows attackers to bypass authentication remotely.
What is the consequence of CVE-2026-24031?
CVE-2026-24031 can lead to unauthorized access to user accounts and potential data breaches.