CVE-2026-21859: 
NixOS vulnerability analysis and mitigation

CVE-2026-21859 is a Server-Side Request Forgery (SSRF) vulnerability in the /proxy endpoint of Mailpit, an email testing tool for developers. It affects all versions up to and including 1.28.0 and was disclosed on January 6, 2026, with a patch released in version 1.28.1. The vulnerability carries a CVSS v3.1 base score of 5.8 (Moderate) per the GitHub Advisory, though NVD scores it at 5.3 (Github Advisory, Mailpit Advisory).

The root cause is CWE-918 (Server-Side Request Forgery): the /proxy endpoint validates that submitted URLs use http:// or https:// schemes but fails to block requests to internal or loopback IP addresses. An unauthenticated remote attacker can craft a GET request to /proxy?url=<internal-url> — for example, GET /proxy?url=http://127.0.0.1:8025/api/v1/info — causing the Mailpit server to fetch and return the response from internal network resources. The fix (commit 3b9b470) replaced the open URL parameter with a base64-encoded data parameter that binds requests to asset URLs extracted from specific message content, and added content-type allowlisting to restrict proxied responses to images, fonts, and CSS only (Mailpit Advisory, Patch Commit).

Successful exploitation allows unauthenticated attackers to make the Mailpit server issue arbitrary HTTP GET requests to internal network resources, resulting in confidentiality impact with no effect on integrity or availability. Specific risks include internal API data disclosure (database paths, runtime statistics), access to all captured email content via internal API endpoints, internal network topology discovery, and — in cloud-hosted deployments — potential access to instance metadata services such as http://169.254.169.254/ on AWS, GCP, or Azure. In containerized or corporate network environments, this can facilitate lateral movement by revealing internal service configurations (Github Advisory).

A proof-of-concept exploit is publicly documented in the official security advisory, demonstrating a trivial single GET request requiring no authentication or special privileges (Mailpit Advisory). Nuclei templates for automated detection and exploitation scanning have been added to the ProjectDiscovery nuclei-templates repository. The EPSS score is approximately 0.485% (66th percentile) per the GitHub Advisory Database, while Feedly reports a lower estimate of 0.009%. There is no confirmed evidence of active in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog (Github Advisory).

1. Reconnaissance: Identify internet-facing Mailpit instances (default port 8025) using tools like Shodan or Censys, targeting versions 1.28.0 and below.
2. Verify exposure: Confirm the /proxy endpoint is accessible without authentication by sending a benign request such as GET /proxy?url=http://example.com.
3. Probe internal services: Send a crafted GET request targeting loopback or internal addresses, e.g., GET /proxy?url=http://127.0.0.1:8025/api/v1/info, to retrieve internal Mailpit API data including database path and runtime statistics.
4. Enumerate internal network: Iterate over common internal IP ranges and ports (e.g., http://192.168.1.1/, http://10.0.0.1:80/) to discover additional internal services.
5. Access cloud metadata (if applicable): In cloud environments, query GET /proxy?url=http://169.254.169.254/latest/meta-data/ to retrieve instance metadata, potentially including IAM credentials.
6. Exfiltrate email content: Use the internal API (e.g., /api/v1/messages) to read all captured emails stored in the Mailpit instance (Mailpit Advisory).

• Network: Unusual outbound HTTP GET requests from the Mailpit server process to internal IP ranges (RFC 1918: 10.x.x.x, 172.16.x.x, 192.168.x.x) or loopback (127.0.0.1); requests to cloud metadata endpoints (169.254.169.254).
• Logs: Mailpit access logs showing repeated GET requests to /proxy?url=http://127.0.0.1... or /proxy?url=http://169.254.169.254...; requests to /proxy with url parameter values pointing to internal hostnames or IP addresses.
• Network: Unexpected port scanning activity originating from the Mailpit host against internal network segments, potentially indicating automated internal service enumeration via SSRF.

Upgrade Mailpit to version 1.28.1 or later, which restricts the /proxy endpoint to only serve asset URLs (images, fonts, CSS) explicitly referenced within message content, and enforces a content-type allowlist (Patch Commit). If immediate patching is not possible, enable basic authentication on the Mailpit web UI and API (a built-in feature), which prevents unauthenticated access to the /proxy endpoint. Additionally, implement network-level egress controls to restrict outbound connections from the Mailpit service to only authorized external resources, and avoid exposing Mailpit directly to the internet (Mailpit Advisory).

The vulnerability was reported by security researcher omarkurt and credited in the official advisory. CrowdSec published a vulnerability tracking report for CVE-2026-21859, and BeyondMachines noted the issue in their threat intelligence feed. The Hacker News weekly recap for the relevant period included mention of the vulnerability. Community discussion was observed on Bluesky and LinkedIn, and the vulnerability was picked up by automated tracking platforms including GlobalSecurityMag and Qualys scanner detections (CrowdSec Report, BeyondMachines).