CVE-2026-85751: Mailu: Authentication bypass in header-based proxy authentication via spoofable `X-Forwarded-By` trust
Mailu is a mail server distributed as a set of Docker images. From Mailu 2.0 until 2024.06.55 and prior to Mailu helm-charts 2.7.3, deployments with PROXYAUTHWHITELIST configured but REALIPHEADER unset trusted a client-controlled X-Forwarded-By header for header-based proxy authentication. The proxyhideheader directive in the nginx template at core/nginx/conf/proxy.conf hid the header from upstream responses but did not overwrite the incoming request value in this configuration. An unauthenticated remote attacker could therefore spoof the trusted proxy identity and bypass authentication. This issue is fixed in Mailu 2024.06.55 and Mailu helm-charts 2.7.3.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Mailuto a version that resolves this vulnerability.Fixed in 2024.06.55 - Upgrade
Upgrade
Mailu helm-chartsto a version that resolves this vulnerability.Fixed in 2.7.3
Event History
Frequently Asked Questions
Which deployments are exposed to this authentication bypass?
Mailu deployments from version 2.0 through 2024.06.55, and Mailu helm-chart deployments before 2.7.3, are affected when PROXY_AUTH_WHITELIST is configured and REAL_IP_HEADER is unset. Deployments that do not use that header-based proxy authentication configuration are not identified as affected by the provided information.
What does an attacker need to exploit the issue?
An unauthenticated remote attacker needs to be able to send requests to the affected Mailu deployment. They can supply a spoofed X-Forwarded-By header to impersonate a trusted proxy identity and bypass authentication.
How can I determine whether my deployment may be vulnerable?
Check whether PROXY_AUTH_WHITELIST is configured while REAL_IP_HEADER is unset, then verify the deployed Mailu or helm-chart version. The vulnerable ranges are Mailu 2.0 through 2024.06.55 and helm-charts versions earlier than 2.7.3.
What remediation is available?
Upgrade Mailu to 2024.06.55 or upgrade the Mailu helm-charts to 2.7.3. The provided information identifies these releases as containing the fix.