CVE-2026-33603 Security feature bypass in OX Dovecot Pro
Attackers can bypass SCRAM TLS channel binding via crafted base64 exchanges, enabling man-in-the-middle eavesdropping on Dovecot client communications.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-33603?
CVE-2026-33603 is a medium-severity vulnerability in Dovecot Dovecot, published on 12 May 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Attacker can use a specially crafted base64 exchange between Dovecot and Client to fake SCRAM TLS channel binding. This requires that the attacker is able to position itself between Dovecot and the client connection. If successful, the attacker can eavesdrop communications between Dovecot and client as MITM proxy. Install fixed version. No publicly available exploits are known.
Weakness: CWE-99
Which versions are affected by CVE-2026-33603?
It affects 2 products.
Products include Dovecot Dovecot, Open-Xchange Dovecot.
How do I fix CVE-2026-33603?
Upgrade to a fixed version.
Is CVE-2026-33603 being exploited?
There is no known exploitation of CVE-2026-33603 in the wild and no public exploit code.
Other vulnerabilities in Dovecot Dovecot
Sources
Also known as ALPINE-CVE-2026-33603, AZL-86802, DEBIAN-CVE-2026-33603, GHSA-gxj9-f8v6-q8h3, UBUNTU-CVE-2026-33603.