UBUNTU-CVE-2026-126133: Medium severity ubuntu/thunderbird vulnerability
When a CalDAV or ICS calendar was accessed through an HTTP proxy that requested authentication, Thunderbird could answer the proxy with the calendar server's username and password. This affected both setting up a new calendar and syncing existing calendars, where a saved password could be sent without any user interaction. A malicious or compromised proxy could use this to obtain the calendar credentials, even for calendars served over HTTPS. This vulnerability was fixed in Thunderbird 160 and Thunderbird 153.7.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Thunderbirdto a version that resolves this vulnerability.Fixed in 160 - Upgrade
Upgrade
Thunderbirdto a version that resolves this vulnerability.Fixed in 153.7
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users who access CalDAV or ICS calendars through an HTTP proxy that requests authentication are exposed. Both new calendar setup and synchronization of existing calendars are affected, including calendars served over HTTPS.
What does an attacker need to exploit it?
An attacker would need to control or compromise an HTTP proxy in the calendar connection path and have that proxy request authentication. The proxy could then obtain the calendar server username and password.
Can credentials be exposed without user interaction?
Yes. During synchronization of an existing calendar, Thunderbird could send a previously saved calendar password to the proxy without any user interaction.
What versions contain the fix?
The issue was fixed in Thunderbird 160 and Thunderbird 153.7.