CVE-2026-33586: Authenticated SMTP Sender Address Forgery

Published Oct 7, 2026

Updated

Authenticated users are able to manipulate both the SMTP envelope “Envelope-from” and “From” fields when sending emails through OVH mail servers.

Due to OVH's default SPF configuration, which commonly includes include:mx.ovh.com, any authenticated user with a valid OVH email account can send messages that appear to originate from any OVH-hosted domains using the default SPF record. Since the SPF policy explicitly authorizes OVH mail servers (mx.ovh.com) to send mail on behalf of these domains, forged messages successfully pass SPF validation despite not being authorized by the impersonated domain owner.

Affected Software

1 affected component

Ovh OVH mail servers

Event History

Oct 7, 2026

CVE Published

via MITRE·03:00 PM

Data Sourced

via MITRE·03:00 PM

DescriptionWeakness

Data Sourced

via NVD·04:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An attacker needs a valid authenticated OVH email account. They can then use OVH mail servers to send messages with manipulated SMTP envelope-from and From fields.

Which domains are exposed to impersonation?

OVH-hosted domains using the default SPF record that authorizes mx.ovh.com are affected. Messages forged as those domains can pass SPF because OVH mail servers are explicitly authorized senders.

Does exploitation require an interaction from the impersonated domain owner?

No. The available CVSS vector indicates low privileges are required and no user interaction is needed; the required privilege is an authenticated OVH email account.

How can an organization determine whether its domain is affected?

Check whether the domain is hosted by OVH and uses the default SPF configuration that includes include:mx.ovh.com. That inclusion authorizes OVH mail servers to send mail for the domain, enabling SPF validation of forged messages sent through those servers.

CVE-2026-33586: Authenticated SMTP Sender Address Forgery

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

Which domains are exposed to impersonation?

Does exploitation require an interaction from the impersonated domain owner?

How can an organization determine whether its domain is affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

Which domains are exposed to impersonation?

Does exploitation require an interaction from the impersonated domain owner?

How can an organization determine whether its domain is affected?