CVE-2026-27851 SQL injection in OX Dovecot Pro
Attackers can perform SQL or LDAP injection via unsafe data unescaping when the safe filter is used with variable expansion in authentication pipelines.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-27851?
CVE-2026-27851 is a high-severity SQL injection vulnerability in Dovecot Dovecot, published on 12 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
When safe filter is used with variable expansion, all following pipelines on the same string are incorrectly interpreted as safe too, enabling unsafe data to be unescaped. This can enable SQL / LDAP injection attacks when used in authentication. Avoid using safe filter until on fixed version. No publicly available exploits are known.
Which versions are affected by CVE-2026-27851?
It affects 2 products.
Products include Dovecot Dovecot, Open-Xchange Dovecot.
How do I fix CVE-2026-27851?
Upgrade to a fixed version.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2026-27851 being exploited?
There is no known exploitation of CVE-2026-27851 in the wild and no public exploit code.
Other vulnerabilities in Dovecot Dovecot
Sources
Also known as ALPINE-CVE-2026-27851, AZL-86799, DEBIAN-CVE-2026-27851, GHSA-xfpv-rrgm-4qqr, UBUNTU-CVE-2026-27851.