Mailcow fixes five flaws, including cross tenant RCE

Five security advisories were published by mailcow on 10 November 2026 for its mailcow-dockerized mail server suite, detailing five distinct flaws that range from stored XSS and SMTP injection to unlimited password guessing and a cross-tenant remote code execution (RCE). The most severe, CVSS 9.1, is a cross-tenant RCE via a domain-wide email footer, described as possible because rspamd renders domain footers as a Jinja template and a sandbox gap lets template code reach system commands within the shared container.

The advisory is linked to CVE-2026-125757 and notes PoC steps publicly, with fixes shipped in releases 2026-07a and 2026-11. The other issues include stored XSS in admin logs (GHSA-xrq6-h4qm-x38v, CVSS 8.3); a domain admin-to-super admin path (GHSA-76cm-26jx-jmhr, CVSS 8.1) via the Full name field; SMTP injection in quarantine release (GHSA-5928-v56c-g8x5, CVSS 7.4); and unlimited password guessing (GHSA-rpvp-3pw9-3vcw, CVSS 7.4).

Affected versions are listed as footer RCE and brute-force flaws in mailcow-dockerized prior to 2026-11, and the log and XSS flaws prior to 2026-07a. The article states there had been no confirmed exploitation in the wild and no CVE IDs assigned at that time, though the five advisories include explicit CVE references and PoC material.

Patched releases are advised: update to mailcow-dockerized 2026-11 or later to cover all five vulnerabilities. If updating immediately is not possible, the quarantine release format can be set to “attachment” to block the SMTP injection, and domain admin accounts and recent footer changes should be reviewed for unexpected template code. The piece notes there is no workaround for the brute-force issue. Claims are attributed to mailcow’s advisories and the reporting outlet, with the explicit CVEs and PoC steps drawn from the published material.