CVE-2026-22689: 
NixOS vulnerability analysis and mitigation

CVE-2026-22689 is a Cross-Site WebSocket Hijacking (CSWSH) vulnerability in Mailpit, an email testing tool and API for developers. The flaw affects all versions from 1.2.6 up to (but not including) 1.28.2, and was disclosed on January 9, 2026, with a patch released the same day. It carries a CVSS v3.1 base score of 6.5 (Medium) (GitHub Advisory, Mailpit Advisory).

The root cause is CWE-1385 (Missing Origin Validation in WebSockets). In server/websockets/client.go, the gorilla/websocket upgrader's CheckOrigin function was explicitly overridden to return true for all requests, completely bypassing the library's built-in Same-Origin Policy (SOP) enforcement. This allows any website's JavaScript to initiate a WebSocket connection to the victim's local Mailpit instance (default ws://localhost:8025/api/events) without restriction. A proof-of-concept HTML page demonstrating the attack is included in the official advisory (Mailpit Advisory, Patch Commit).

Exploitation results in a high confidentiality impact with no integrity or availability impact. An attacker who successfully hijacks the WebSocket connection can intercept all real-time broadcast data from the victim's Mailpit instance, including full email contents, sender and recipient metadata, email subjects, and server/mailbox statistics. Since Mailpit is typically used in local development environments to capture application-generated emails, intercepted data may include password reset links, authentication tokens, registration confirmations, and other sensitive application data (GitHub Advisory).

A proof-of-concept exploit is publicly available as part of the official security advisory, consisting of a simple HTML page that can be served from any origin to hijack the WebSocket connection (Mailpit Advisory). Exploitation requires user interaction — the developer must visit a malicious website while Mailpit is running locally. There is no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.007% (1st percentile), indicating a low probability of near-term exploitation (GitHub Advisory). The vulnerability is not listed in the CISA KEV catalog.

1. Setup malicious page: The attacker creates an HTML page containing JavaScript that opens a WebSocket connection to ws://localhost:8025/api/events (Mailpit's default WebSocket endpoint) and exfiltrates received data to an attacker-controlled server.
2. Host the page: The attacker serves the malicious HTML from any origin — for example, a public website, a phishing page, or even a local file served via python3 -m http.server 8000.
3. Social engineering: The attacker tricks a developer who is running Mailpit locally into visiting the malicious page (e.g., via a phishing link, a compromised legitimate site, or a malicious advertisement).
4. WebSocket hijacking: When the developer's browser loads the malicious page, the JavaScript initiates a cross-origin WebSocket connection to ws://localhost:8025/api/events. Because Mailpit's CheckOrigin function returns true for all origins, the browser permits the connection without restriction.
5. Data exfiltration: The attacker's page receives all real-time WebSocket broadcast events from Mailpit, including email contents, sender/recipient information, subjects, and server statistics, which are forwarded to the attacker's server (Mailpit Advisory).

• Network: Outbound WebSocket connections from a browser to ws://localhost:8025/api/events originating from a page served by a non-localhost domain; unexpected cross-origin WebSocket upgrade requests in browser developer tools or network proxies.
• Logs: Mailpit access logs showing WebSocket upgrade requests (GET /api/events HTTP/1.1, Upgrade: websocket) with Origin headers pointing to external or unexpected domains (e.g., Origin: http://attacker.com or Origin: http://127.0.0.1:8000).
• Browser: Browser console or network tab showing active WebSocket connections to localhost:8025 initiated from a third-party website.

Upgrade Mailpit to version 1.28.2 or later, which removes the unsafe CheckOrigin override and restores the gorilla/websocket library's default behavior of validating that the Origin header matches the Host header (Patch Commit). If immediate patching is not possible, developers should avoid visiting untrusted websites while Mailpit is running locally. As an additional control, firewall rules or network segmentation can be used to restrict access to Mailpit's port (default 8025) to trusted interfaces only (GitHub Advisory).

The vulnerability was reported by security researcher omarkurt and credited in the official advisory (Mailpit Advisory). A blog post titled "Two CVEs, Zero Ego: A Mailpit Story" was published at rosecurify.com, providing additional context on the discovery. The vulnerability was also mentioned in The Hacker News' weekly security recap (The Hacker News) and covered by cyber.netsecops.io. Community reaction has been measured, consistent with the moderate severity rating and the developer-tool-focused attack surface.