CVE-2026-84642: 
NixOS Análisis y mitigación de vulnerabilidades

CVE-2026-84642 is an authorization bypass vulnerability in Mozilla Thunderbird caused by improper handling of the mail.allowed_attachment_hostnames advanced configuration setting. The values in this setting were used directly in a regular expression without proper escaping, allowing certain unintended hostnames to match the allowlist and serve remote attachments. It affects Thunderbird versions prior to 155 and prior to 153.2 (ESR). Discovered and reported by ChinhNguyen and Lowk3yz, it was publicly disclosed on September 1, 2026, with a CVSS category estimate of Medium and a low impact severity rating (Mozilla MFSA2026-88, Mozilla MFSA2026-86).

The root cause is improper neutralization of special elements used in a regular expression (related to CWE-185: Incorrect Regular Expression). Thunderbird uses the mail.allowed_attachment_hostnames configuration value directly as a regex pattern without escaping regex metacharacters. Because certain valid hostnames may contain characters that have special meaning in regular expressions (e.g., . matching any character), an attacker who controls a hostname that partially matches the unescaped pattern could bypass the allowlist restriction. The precondition for exploitation is that a victim has configured one or more entries in mail.allowed_attachment_hostnames, and the attacker can craft or control a hostname that exploits the unescaped regex behavior (Mozilla MFSA2026-88, Mozilla MFSA2026-86, Mozilla Bugzilla).

Successful exploitation allows an attacker to serve remote attachments from hostnames that should not be permitted by the configured allowlist, effectively bypassing the attachment hostname restriction. This could expose users to content from unauthorized or malicious remote servers when viewing emails with remote attachments. The impact is primarily an integrity and confidentiality concern — users may unknowingly load content from attacker-controlled infrastructure — though the overall severity is rated low given the limited scope and the requirement for a specific non-default configuration (Mozilla MFSA2026-88, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the disclosure date (Feedly). The EPSS score is 0.0, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires that the target user has manually configured the mail.allowed_attachment_hostnames setting, which is a non-default advanced configuration, limiting the practical attack surface.

Mozilla has released patches addressing this vulnerability in Thunderbird 155 and Thunderbird ESR 153.2, both announced on September 1, 2026. Users should update to one of these versions immediately (Mozilla MFSA2026-86, Mozilla MFSA2026-88). As a workaround prior to patching, administrators and users should review and clear the mail.allowed_attachment_hostnames advanced config setting, or restrict remote attachment functionality entirely if it is not required (Feedly).