CVE-2026-104704 Cleartext Transmission of Sensitive Information in hMailServer
An attacker can downgrade SMTP connections to cleartext by exploiting DANE validation flaws, allowing interception and modification of email messages.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-104704?
CVE-2026-104704 is a high-severity vulnerability in Progressive Robot Ltd hMailServer, published on 8 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Progressive Robot hMailServer 6.0.0 through 6.3.5 does not enforce TLS for outbound SMTP delivery to a mail exchanger whose DNSSEC-validated TLSA records contain no DANE-EE (usage 3) record, contrary to RFC 7672 section 2.2. The server used only DANE-EE records and treated a validated TLSA record set consisting of DANE-TA (usage 2) or otherwise unusable records as if no records were published, so delivery to such a host fell back to opportunistic TLS. An attacker with an active position on the network path between the server and the recipient's mail exchanger can suppress or break the STARTTLS negotiation and cause messages to be delivered in cleartext, where they can be read and modified.
Weakness: CWE-319
Which versions are affected by CVE-2026-104704?
How do I fix CVE-2026-104704?
No fix has been published for CVE-2026-104704 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-104704 being exploited?
There is no known exploitation of CVE-2026-104704 in the wild and no public exploit code.
Sources
Also known as GHSA-gv77-q2r2-h9qj.