CVE-2026-121426: 
Grafana vulnerability analysis and mitigation

CVE-2026-121426 is an address parsing vulnerability in Nodemailer's addressparser component that allows unauthenticated attackers to bypass recipient allow lists and redirect email to attacker-controlled domains. The flaw affects Nodemailer versions 3.0.0 through 10.1.3 (fixed in 10.1.4) and was discovered during an internal review on 2026-10-18, with public disclosure on November 3, 2026. It carries a CVSS v3.1 score of 6.5 (Medium) and a CVSS v4.0 score of 8.3 (High) (GitHub Advisory, Github Advisory DB).

The root cause is improper input validation (CWE-20) combined with an interpretation conflict (CWE-436) in Nodemailer's addressparser. The parser terminates an angle-addr (<...>) at the first > character it encounters, even when that > appears inside a quoted local part, comment, or domain literal — contexts where RFC 5322 requires it to be treated as literal data. For example, the address <"a@evil.com>"@good.com> is a valid RFC 5322 mailbox for "a@evil.com>"@good.com, but Nodemailer's parser reads it as an address at evil.com, issuing RCPT TO:<"a"@evil.com> during SMTP delivery. Because a conformant validator (e.g., Python's email._header_value_parser) correctly parses the same string as a good.com address, allow-list checks pass while delivery goes to the attacker's domain (GitHub Advisory).

Successful exploitation causes email messages intended for an allowed domain to be silently delivered to an attacker-controlled domain, resulting in high-severity confidentiality impact and low integrity impact with no availability effect. Any content the application places in the email — including invitation tokens, password reset links, PII, or business communications — is disclosed to the attacker. Applications using Nodemailer to enforce recipient allow lists (e.g., invite-only or domain-restricted notification systems) and consumers of the standalone mailparser library are both affected (GitHub Advisory, Github Advisory DB).

No public proof-of-concept exploit code has been published and there is no evidence of in-the-wild exploitation at this time (Feedly). The EPSS score is 0.0, reflecting very low current exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires the attacker to control a recipient or sender address value passed to Nodemailer — a realistic condition in contact forms, invite flows, or inbound mail parsing pipelines — but no special privileges or user interaction are needed (GitHub Advisory).

1. Identify a target application: Find a web application that uses Nodemailer (versions 3.0.0–10.1.3) to send emails and enforces a recipient allow list based on domain (e.g., only allows @good.com addresses).
2. Craft a malicious address: Construct an RFC 5322-compliant address that embeds the attacker's domain inside a quoted local part, such as <"a@evil.com>"@good.com>. This address passes conformant validators as a good.com mailbox.
3. Submit the address: Enter the crafted address into the application's input field (e.g., an invitation form, notification recipient field, or inbound email header).
4. Allow-list bypass: The application's validator (or any conformant RFC 5322 parser) reads the domain as good.com and approves the address, passing it to Nodemailer.
5. Delivery to attacker domain: Nodemailer's addressparser terminates the angle-addr at the first >, parsing the address as "a"@evil.com and issuing RCPT TO:<"a"@evil.com> to the SMTP server.
6. Receive the email: The SMTP server delivers the message to evil.com, where the attacker receives the full email content, including any sensitive tokens, links, or data the application included (GitHub Advisory).

• Network: SMTP RCPT TO commands in mail server logs containing quoted local parts with embedded @ and > characters (e.g., RCPT TO:<"a"@evil.com>); outbound SMTP connections to unexpected or external domains not present in the application's allow list.
• Logs: Application logs showing email dispatch to addresses containing > inside quoted strings or unusual angle-bracket patterns; Nodemailer debug logs (if enabled) showing parsed addresses that differ from the submitted input.
• Application Input: Form submissions or API requests containing recipient addresses matching the pattern <"..@attacker-domain.com>"@allowed-domain.com> in To, Cc, or Bcc fields.
• Mail Server: Bounce or delivery reports for messages sent to domains not in the application's allow list; unexpected entries in the mail transfer agent's delivery log for external domains (GitHub Advisory).

Upgrade Nodemailer to version 10.1.4 or later, which fixes the parser to correctly track quoted strings, comments, and domain literals inside angle-addrs before reading the closing > (GitHub Advisory). As a defense-in-depth measure, applications should independently validate recipient domains after Nodemailer parses the address, rather than relying solely on a pre-parse allow-list check. Additionally, consider rejecting any submitted address containing > characters inside quoted local parts at the application input layer. Red Hat has tracked this issue in Bugzilla (Bug 2565873) for downstream package assessment (Red Hat Bugzilla).

The vulnerability was reported by the Nodemailer maintainer (andris9) following an internal review of addressparser on 2026-10-18 and published as a Moderate-severity advisory (GHSA-85x2-q946-cp5h) on October 19, 2026 (GitHub Advisory). Red Hat opened a tracking bug (2565873) classifying it as medium severity for their product lines (Red Hat Bugzilla). VulnCheck assigned the CVE and published an advisory noting the recipient domain confusion impact (Github Advisory DB). No significant broader media coverage or notable researcher commentary beyond the official advisory has been identified at this time.