A Server-Side Request Forgery (SSRF) vulnerability exists in Mailpit's /proxy endpoint that allows attackers to make requests to internal network resources.
The /proxy endpoint allows requests to internal network resources. While it validates http:// and https:// schemes, it does not block internal IP addresses, allowing attackers to access internal services and APIs.
GET /proxy?url=http://127.0.0.1:8025/api/v1/info
This returns internal API data including database path and runtime statistics.
Attacker can probe and discover internal services on the network.
Access to internal API data, database paths, and runtime statistics.
Ability to read all captured emails via internal API endpoints.
If deployed in cloud environments (AWS/GCP/Azure), potential access to instance metadata services (e.g., http://169.254.169.254/).
If Mailpit is accidentally exposed to the internet, attackers can leverage SSRF to access internal development resources and services.
In containerized deployments, SSRF can reveal container metadata and internal service configurations.
In corporate networks, SSRF can be used to discover and interact with internal services, facilitating lateral movement.
This vulnerability is limited to HTTP GET requests with minimal headers. Additionally, Mailpit's web UI & API should be protected by basic authentication when exposed to the internet, which prevents access to the proxy endpoint.
| Score | Percentile |
|---|---|
| 1.02% | 76.98% |
| Base score | Version | Severity | Vector |
|---|---|---|---|
| 5.8 | 3.1 | — |
|
| Type | Value |
|---|---|
| GHSA | GHSA-8v65-47jx-7mfr ↗ |
| CVE | CVE-2026-21859 ↗ |
| CWE id | Name |
|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) |
Vulnerable version ranges and first patched releases as published by GitHub.
| Ecosystem | Package | Vulnerable range | First patched | Vulnerable functions |
|---|---|---|---|---|
| go | github.com/axllent/mailpit | <= 1.28.0 | 1.28.1 | — |