Loading story…
A remote code execution flaw tracked as CVE-2026-41113 was disclosed in the sagredo-dev/qmail fork after researchers found that qmail-remote could build and execute a shell command from an attacker-controlled MX hostname. The bug sits in tls_quit() and was introduced by the notlshosts_auto feature added in October 2024, which automatically records hosts that fail TLS. If a target mail server sends mail to a domain whose DNS MX record is controlled by an attacker, a crafted hostname containing shell metacharacters can be passed through sprintf() into popen(), allowing arbitrary commands to run as the qmailr user when control/notlshosts_auto is enabled.
The issue affects sagredo-dev/qmail versions v2024.10.26 through v2026.04.02 and was fixed in v2026.04.07 by commit 749f607, which removes shell execution, adds stricter FQDN validation, and replaces the vulnerable logic with safer file handling using open() and snprintf(). Public writeups and a GitHub repository published technical analysis, a Docker-based reproduction environment, and proof-of-concept exploit material showing the chain from crafted DNS responses to command execution, with one example writing id output to /tmp/qmail_rce_proof. The vulnerability carries a reported CVSS 3.1 score of 8.2 (High), and maintainers advised users of the community-patched qmail fork—not original qmail 1.03—to upgrade immediately.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
A public GitHub repository released proof-of-concept exploit code, technical analysis, and a Docker-based reproduction environment for the qmail RCE. The materials demonstrated exploitation leading to creation of /tmp/qmail_rce_proof with id output as qmailr.
Researchers publicly documented the vulnerability in sagredo's qmail fork, explaining that attacker-controlled MX data could reach popen() in tls_quit() and yield code execution as qmailr. The post states the issue had been reported, assigned CVE-2026-41113, and fixed in commit 749f607 and release v2026.04.07.
sagredo-dev published release v2026.04.07, describing a security issue involving remote code execution via shell injection in the qmail-remote TLS error handler. Multiple references state this release fixed CVE-2026-41113.
A fix for the command injection vulnerability was committed in sagredo-dev/qmail as commit 749f607. The patch removed shell-based popen behavior, added safer file handling and hostname validation, and credited Diep Pham with identifying the issue.
The vulnerable notlshosts_auto logic was added to sagredo-dev/qmail in October 2024, introducing behavior that later enabled shell injection through attacker-controlled MX hostnames. Affected versions are described as starting with v2024.10.26.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
6 references tracked. Mallory keeps watching after this page renders.
github.com
Open sourceblog.calif.io
Open sourceopennet.me
Open sourcegithub.com
Open sourcegithub.com
Open sourceseclists.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Openfind **MailGates/MailAudit** and **Sagredo qmail** were disclosed with critical remote code execution vulnerabilities that could let attackers compromise exposed mail infrastructure. **CVE-2026-6350** affects Openfind MailGates/MailAudit and is a stack-based buffer overflow (`CWE-121`) that allows an unauthenticated remote attacker to control execution flow and run arbitrary code. The flaw carries a **CVSS v3.1** score reflecting network exploitation with no privileges or user interaction and high impact across confidentiality, integrity, and availability, and was referenced in advisories published by **TWCERT/CC**. A second flaw, **CVE-2026-41113**, affects **Sagredo qmail** versions before `2026.04.07` and enables remote code execution through `tls_quit` because `qmail-remote.c` uses `popen` in the `notlshosts_auto` component, a command injection issue tracked as `CWE-78`. The vulnerability was documented with references to public research, a GitHub publications repository, the fixing commit, pull request `#42`, and the patched `v2026.04.07` release, giving defenders a clear remediation path while underscoring the risk to internet-facing email systems.
Jun 29, 2026
qmail has been hit by multiple remote code execution issues spanning legacy and actively maintained codebases. Qualys reported that **CVE-2005-1513**, long believed unexploitable in default installations, can be triggered remotely through `qmail-local` on Debian’s default qmail package by sending a nearly 4 GB mail header that causes an integer overflow in `stralloc_readyplus`, leading to a large buffer overflow and arbitrary command execution as any non-root local user. The same research also identified **CVE-2020-3811**, a recipient verification bypass in the bundled `qmail-verify` component, and **CVE-2020-3812**, a local information disclosure issue tied to privileged file existence checks.
Jun 29, 2026
Two high-severity vulnerabilities were disclosed in mail server software that allow **unauthenticated remote code execution** through crafted SMTP input. `CVE-2019-25646` affects **Tabs Mail Carrier 2.5.1**, where an oversized `MAIL FROM` parameter triggers a **buffer overflow** on the SMTP service listening on port 25. The flaw can overwrite the `EIP` register and enable execution of attacker-controlled payloads, including a bind shell, giving remote attackers a direct path to code execution. A second flaw, `CVE-2025-71275`, affects **Zimbra Collaboration Suite 8.8.15** in the **PostJournal** service. In that case, improper sanitization of the SMTP `RCPT TO` parameter allows **command injection** via shell expansion syntax, leading to arbitrary command execution under the Zimbra service account. Both issues were classified with high impact across confidentiality, integrity, and availability, underscoring the risk posed by exposed SMTP services that process untrusted sender and recipient fields without adequate bounds checking or input sanitization.
Jun 29, 2026