CVE-2026-0394: 
Dovecot vulnerability analysis and mitigation

CVE-2026-0394 is a path traversal vulnerability in Dovecot's per-domain passwd file handling that allows unauthenticated remote attackers to inadvertently read sensitive files such as /etc/passwd. It affects Dovecot versions prior to 2.4.0 and Open-Xchange (OX) Dovecot Pro versions prior to 3.1.0. The vulnerability was published on March 27, 2026, and is assigned a CVSS v3.1 base score of 5.3 (Medium) (Feedly, OX Advisory).

The root cause is improper limitation of a pathname to a restricted directory (CWE-22 / Path Traversal). The vulnerability is triggered when Dovecot is configured to use per-domain passwd files that are placed one path component above /etc, or when the slash character has been added to the set of allowed characters in domain names. If the domain component in an authentication request is a directory partial match, Dovecot constructs a file path that traverses outside the intended directory, inadvertently resolving to /etc/passwd or a similarly named file. No special privileges or user interaction are required — the attack is network-accessible and exploitable without authentication (OX Advisory, oss-sec).

Successful exploitation allows an unauthenticated attacker to read the contents of /etc/passwd or other files whose path ends with passwd. If the exposed file contains password hashes or cleartext credentials, those can be leveraged for unauthorized authentication against the Dovecot mail service. Additionally, if the traversed file is used as a userdb, system users may be unexpectedly recognized as valid Dovecot users, potentially granting unauthorized access to the mail system. The impact is limited to confidentiality (low), with no integrity or availability impact (Feedly, OX Advisory).

1. Reconnaissance: Identify Dovecot mail servers exposed to the network running versions prior to 2.4.0 (community) or 3.1.0 (OX Dovecot Pro) using banner grabbing or service enumeration tools.
2. Identify vulnerable configuration: Confirm the target is configured to use per-domain passwd files located one path component above /etc (e.g., /etc/%d/passwd), or that slash is permitted in domain names.
3. Craft malicious authentication request: Submit an authentication request using a domain component that acts as a directory traversal sequence (e.g., using a domain like ../ or a partial directory name) so that Dovecot constructs a file path resolving to /etc/passwd.
4. Read sensitive file: If the traversal succeeds, Dovecot reads /etc/passwd (or a similarly named file) as the passwd database, exposing its contents to the attacker.
5. Leverage credentials: Use any obtained password hashes or credentials to attempt unauthorized authentication against Dovecot or other services on the host (OX Advisory, oss-sec).

• Network: Unusual or malformed authentication requests to Dovecot containing domain components with path traversal sequences (e.g., ../, encoded slashes) in IMAP/POP3/SMTP login attempts.
• Logs: Dovecot authentication logs showing login attempts with domain names containing directory separators or partial directory names; unexpected references to /etc/passwd in Dovecot debug or error logs.
• File System: No direct file system artifacts expected, but monitor for unexpected access to /etc/passwd by the Dovecot process (e.g., via auditd rules on file open events for /etc/passwd by the dovecot or auth process).
• Process: Dovecot auth worker process accessing files outside the configured passwd file directory (OX Advisory).

The primary remediation is to upgrade Dovecot to version 2.4.0 or later (community edition) or OX Dovecot Pro to version 3.1.0 or later (OX Advisory). If immediate patching is not feasible, relocate per-domain passwd files to a path that is not susceptible to traversal, such as /etc/dovecot/auth/%d. Alternatively, switch to an authentication scheme that does not rely on file paths derived from user-supplied domain components. Ubuntu users should apply USN-8136-1 / USN-8136-2, and Debian users should apply DSA-6197 or DLA-4556-1 (Ubuntu Advisory, Debian LTS).

The vulnerability was disclosed via the oss-security mailing list and Seclists Full Disclosure, generating routine coverage among Linux distribution security teams (oss-sec, Full Disclosure). Ubuntu, Debian, and their derivatives issued security advisories and updated packages promptly following the disclosure. Community reaction has been measured, consistent with the medium severity rating and absence of public exploits.