CVE-2026-27851: 
Dovecot vulnerability analysis and mitigation

CVE-2026-27851 is a filter-handling vulnerability in Dovecot (and OX Dovecot Pro) that enables SQL and LDAP injection attacks through authentication mechanisms. When the safe filter is used with variable expansion, all subsequent pipelines on the same string are incorrectly treated as safe, allowing unsafe data to pass through unescaped. The vulnerability affects Dovecot versions prior to 2.4.4 and OX Dovecot Pro versions prior to 3.1.5. It was published on May 12, 2026, with a CVSS v3.1 base score of 9.1 (Critical) per Feedly/NVD estimates, and 7.4 (High) per the vendor and GitHub Advisory (GitHub Advisory, OX Advisory).

The root cause is classified as CWE-235 (Improper Handling of Extra Parameters), where Dovecot's template/filter pipeline logic fails to correctly scope the safe designation — once a string is marked safe via the safe filter with variable expansion, all subsequent pipeline operations on that string inherit the safe status incorrectly, bypassing escaping logic. This allows attacker-controlled input to be injected into SQL or LDAP queries without proper sanitization, particularly in authentication contexts. The attack requires no privileges and no user interaction, and is exploitable remotely over the network, though the vendor-assigned CVSS score reflects high attack complexity (GitHub Advisory, OX Advisory).

Successful exploitation allows an unauthenticated remote attacker to inject arbitrary SQL or LDAP commands through Dovecot's authentication mechanisms, potentially bypassing authentication entirely or accessing unauthorized data. The confidentiality and integrity impacts are rated High, as attackers could read sensitive mail account data or manipulate directory/database records; availability is not directly impacted. In environments using SQL or LDAP backends for Dovecot authentication, this could lead to full authentication bypass and unauthorized access to user mailboxes (GitHub Advisory, OX Advisory).

1. Reconnaissance: Identify Dovecot mail servers running versions prior to 2.4.4 (community) or 3.1.5 (OX Dovecot Pro) using network scanning tools such as Shodan or Nmap, targeting IMAP/POP3/LMTP ports (143, 993, 110, 995).
2. Identify SQL/LDAP authentication backend: Determine whether the target Dovecot instance uses an SQL or LDAP backend for authentication (e.g., by observing error messages, banner information, or configuration leaks).
3. Craft malicious authentication payload: Construct a login request where the username or password field contains SQL or LDAP injection syntax (e.g., ' OR '1'='1 for SQL, or *)(uid=*))(|(uid=* for LDAP) that will be processed by a template pipeline using the safe filter.
4. Trigger unsafe unescaping: Submit the crafted authentication request to the Dovecot service; the safe filter's incorrect propagation causes the injected payload to bypass escaping and be passed raw to the backend query.
5. Achieve objective: Depending on the backend, the attacker may bypass authentication (logging in as any user), enumerate accounts, or extract sensitive data from the SQL/LDAP directory (GitHub Advisory, OX Advisory).

• Network: Unusual or malformed authentication attempts to Dovecot IMAP/POP3 ports (143, 993, 110, 995) containing SQL metacharacters (', --, OR, UNION) or LDAP special characters (*, (, ), |, &) in username or password fields.
• Logs: Dovecot authentication logs (/var/log/dovecot.log or /var/log/mail.log) showing repeated failed or anomalous login attempts with unusual characters in credentials; SQL or LDAP error messages logged by the backend database or directory service.
• Database/Directory: Unexpected queries in SQL slow query logs or LDAP access logs originating from the Dovecot service account containing injected syntax; unauthorized account access or privilege escalation in the mail database.
• Process: Dovecot worker processes making unexpected outbound connections or exhibiting abnormal query patterns to the SQL/LDAP backend.

Upgrade Dovecot to version 2.4.4 or later (community edition) or OX Dovecot Pro to version 3.1.5 or later to fully remediate the vulnerability (OX Advisory). As an immediate workaround prior to patching, avoid using the safe filter in Dovecot template/pipeline configurations, particularly in authentication-related contexts (GitHub Advisory). Distribution-specific patches have been released for openSUSE, Ubuntu (USN-8365-1), and Fedora 44, and users of these platforms should apply available package updates promptly (Ubuntu Advisory, openSUSE).

The vulnerability was disclosed via the oss-security mailing list and Seclists Full Disclosure in May 2026, indicating standard coordinated disclosure practices (oss-sec, Full Disclosure). Major Linux distributions including Ubuntu, openSUSE, and Fedora responded promptly with security update advisories. No notable independent researcher commentary or significant social media discussion has been identified beyond standard vulnerability tracking and distribution advisories.