CVE-2026-40871: mailcow: dockerized vulnerable to Second Order SQL Injection in quarantine category via API
mailcow: dockerized is an open source groupware/email suite based on docker. Versions prior to 2026-03b have a second-order SQL injection vulnerability in the quarantinecategory field via the Mailcow API. The /api/v1/add/mailbox endpoint stores quarantinecategory without validation or sanitization. This value is later used by quarantinenotify.py, which constructs SQL queries using unsafe % string formatting instead of parameterized queries. This results in a delayed (second-order) SQL injection when the quarantine notification job executes, allowing an attacker to inject arbitrary SQL. Using a UNION SELECT, sensitive data (e.g., admin credentials) can be exfiltrated and rendered inside quarantine notification emails. Version 2026-03b fixes the vulnerability.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
mailcow: dockerizedto a version that resolves this vulnerability.Fixed in 2026-03b
Event History
Frequently Asked Questions
What is the severity of CVE-2026-40871?
CVE-2026-40871 is classified as a high-severity vulnerability due to its potential for exploitation through SQL injection.
How do I fix CVE-2026-40871?
To fix CVE-2026-40871, upgrade your mailcow: dockerized installation to version 2026-03b or later.
What type of vulnerability is CVE-2026-40871?
CVE-2026-40871 is a second-order SQL injection vulnerability affecting the quarantine_category field via the Mailcow API.
Which versions of mailcow: dockerized are affected by CVE-2026-40871?
Versions of mailcow: dockerized prior to 2026-03b are vulnerable to CVE-2026-40871.
What impact does CVE-2026-40871 have on my system?
CVE-2026-40871 can allow attackers to manipulate database queries, potentially leading to unauthorized access to sensitive information.