CVE-2026-85751 Mailu: Authentication bypass in header-based proxy authentication via spoofable `X-Forwarded-By` trust
An unauthenticated attacker can bypass authentication in Mailu by spoofing the X-Forwarded-By header when specific proxy settings are enabled.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-85751?
CVE-2026-85751 is a critical authentication bypass vulnerability in Mailu, published on 21 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Mailu is a mail server distributed as a set of Docker images. From Mailu 2.0 until 2024.06.55 and prior to Mailu helm-charts 2.7.3, deployments with PROXY_AUTH_WHITELIST configured but REAL_IP_HEADER unset trusted a client-controlled X-Forwarded-By header for header-based proxy authentication. The proxy_hide_header directive in the nginx template at core/nginx/conf/proxy.conf hid the header from upstream responses but did not overwrite the incoming request value in this configuration. An unauthenticated remote attacker could therefore spoof the trusted proxy identity and bypass authentication. This issue is fixed in Mailu 2024.06.55 and Mailu helm-charts 2.7.3.
Which versions are affected by CVE-2026-85751?
How do I fix CVE-2026-85751?
No fix has been published for CVE-2026-85751 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-85751 being exploited?
There is no known exploitation of CVE-2026-85751 in the wild and no public exploit code.
Sources
Also known as GHSA-rfhj-4wcq-74xg.