CVE-2026-23845: 
NixOS vulnerability analysis and mitigation

CVE-2026-23845 is a Server-Side Request Forgery (SSRF) vulnerability in Mailpit, an email testing tool and API for developers. The flaw exists in versions prior to 1.28.3 and is triggered via the HTML Check feature's CSS download mechanism. It was disclosed on January 18, 2026, by security researchers mdisec (reporter) and omarkurt (coordinator), with the patch released the same day. The vulnerability carries a CVSS v3.1 base score of 5.8 (Moderate) per the GitHub Advisory, or 7.5 (High) per NVD scoring (Github Advisory, Mailpit Advisory).

The root cause is CWE-918 (Server-Side Request Forgery), stemming from insufficient URL validation in the isURL() function and unrestricted HTTP fetching in the downloadToBytes() function within internal/htmlcheck/css.go. When the HTML Check API endpoint (/api/v1/message/{ID}/html-check) processes an email, the inlineRemoteCSS() function automatically fetches any URL found in <link rel="stylesheet" href="..."> tags without validating whether the destination is a private/internal IP, a cloud metadata endpoint, or any other restricted resource. An unauthenticated attacker can send a crafted HTML email containing a malicious stylesheet link pointing to an internal resource, then trigger the HTML check API to cause the Mailpit server to make an arbitrary outbound HTTP GET request and return the response (Github Advisory, Mailpit Advisory).

Successful exploitation allows an unauthenticated network attacker to probe and access internal resources, backend services, and cloud metadata endpoints (e.g., AWS IMDSv1 at 169.254.169.254) from the Mailpit server's network perspective. This can expose sensitive information such as cloud IAM credentials, internal service data (e.g., Redis), or other confidential backend content. There is no integrity or availability impact; the risk is confined to confidentiality of internal network resources accessible from the Mailpit host (Mailpit Advisory, Github Advisory).

A proof-of-concept exploit (ssrf_htmlcheck_poc.py) is publicly available and referenced in the official security advisory. The PoC demonstrates SSRF callbacks to a local listener, cloud metadata endpoints, and internal services such as Redis. As of the advisory publication, there is no evidence of active in-the-wild exploitation. The EPSS score is approximately 0.024% (0.000280 per Feedly), placing it in the 7th percentile for exploitation likelihood. The vulnerability is not listed in the CISA KEV catalog (Github Advisory, Mailpit Advisory).

1. Reconnaissance: Identify a Mailpit instance running version ≤ 1.28.2 with its HTTP API accessible (default port 8025) and SMTP port open (default 1025).
2. Craft malicious email: Compose an HTML email containing a <link rel="stylesheet" href="http://<internal-target>/"> tag, where <internal-target> is the desired SSRF destination (e.g., 169.254.169.254/latest/meta-data/iam/security-credentials/ for AWS metadata, 127.0.0.1:6379 for Redis, or an attacker-controlled listener).
3. Deliver email via SMTP: Send the crafted HTML email to the Mailpit SMTP server (e.g., using Python's smtplib or sendmail).
4. Retrieve message ID: Query the Mailpit API to obtain the message ID of the delivered email: curl -s http://<mailpit-host>:8025/api/v1/messages?limit=1 | jq -r '.messages[0].ID'.
5. Trigger HTML Check: Send a GET request to the HTML Check endpoint: curl -v "http://<mailpit-host>:8025/api/v1/message/<MESSAGE_ID>/html-check". This causes Mailpit to invoke inlineRemoteCSS(), which fetches the attacker-specified URL.
6. Collect SSRF response: If the target returns data (e.g., cloud credentials), it is downloaded as "CSS content" and may be observable via error messages or response data. An attacker-controlled listener can confirm the SSRF callback and capture any returned content (Mailpit Advisory, Github Advisory).

• Network: Unexpected outbound HTTP GET requests from the Mailpit server to internal IP ranges (RFC 1918: 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), loopback addresses (127.0.0.1), or cloud metadata endpoints (169.254.169.254); connections with User-Agent: Mailpit/dev or Mailpit HTML Checker/<version> to non-public destinations.
• Logs: Mailpit application logs containing [html-check] failed to download <internal-URL> or [html-check] ignoring unsupported stylesheet URL entries referencing internal/private addresses; access logs showing repeated calls to /api/v1/message/{ID}/html-check from unexpected sources.
• Process: Unusual outbound TCP connections initiated by the Mailpit process to ports such as 6379 (Redis), 80, 443, or 8080 on internal hosts.
• File System: Presence of ssrf_htmlcheck_poc.py or similar exploit scripts on attacker-controlled systems interacting with the Mailpit SMTP or HTTP API (Mailpit Advisory).

The primary remediation is to upgrade Mailpit to version 1.28.3 or later, which replaces the vulnerable downloadToBytes() and isURL() functions with a safe HTTP client (newSafeHTTPClient()) that enforces redirect limits, content-type validation (text/css required), a 5MB download cap, and stricter URL validation rejecting credentials and bare hostnames (Mailpit Release, Patch Commit). If immediate patching is not possible, restrict access to the /api/v1/message/{ID}/html-check endpoint to trusted users only, enable the --block-remote-css-and-fonts flag to prevent remote CSS downloads, and implement network egress controls to prevent the Mailpit server from reaching internal resources (Mailpit Advisory).

The vulnerability was responsibly disclosed by security researchers mdisec and omarkurt, who were credited in the official Mailpit v1.28.3 release notes. The maintainer responded promptly, releasing the patch on the same day as the advisory (January 18, 2026). No significant broader media coverage or notable community controversy has been identified beyond standard vulnerability database aggregation (Mailpit Release, Github Advisory).