CVE-2026-42008: Medium severity Dovecot dovecot vulnerability
Forwarding information received from a host listed as a trusted proxy is not kept separate from Dovecot's own authentication fields, so a value sent by that host can be injected as an internal authentication field. Any host permitted to act as a trusted proxy can authenticate as any user without knowing that user's password. This affects deployments whose password database honours a field that permits authentication without a password. Deployments that do not configure trusted proxies are not affected. Restrict the list of trusted proxy networks to hosts that are fully under your control. Update to non-vulnerable version. No publicly available exploits are known.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Restrict the list of trusted proxy networks to hosts that are fully under your control.
Event History
Frequently Asked Questions
Which deployments are exposed?
Only deployments that configure trusted proxies and use a password database that honors a field allowing authentication without a password are affected. Deployments with no trusted proxies configured are not affected.
What access does an attacker need to exploit this?
An attacker needs to send forwarding information from a host that is permitted to act as a trusted proxy. Such a host can authenticate as any user without knowing that user's password.
What should be done if an update cannot be applied immediately?
Restrict trusted proxy networks to hosts fully under your control. This reduces exposure by preventing untrusted systems from being treated as trusted proxies.
Are public exploits available?
No publicly available exploits are known.