Is CVE-2026-101015 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-101015 being exploited in the wild.

How severe is CVE-2026-101015?

High severity, with a CVSS score of 7.3, published 28 September 2026.

Which products and versions are affected?

Trusted Domain Project OpenDMARC up to 1.4.2.

Is there a fix for CVE-2026-101015?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-101015 attacked?

It is attacked over the network.

Am I affected by CVE-2026-101015?

Check whether you run Trusted Domain Project OpenDMARC at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-101015: Trusted Domain Project OpenDMARC input validation in policy.c

CVE-2026-101015 · Severity: high · CVSS 7.3 · Published 2026-09-28

OpenDMARC is an email authentication system that validates DMARC protocol compliance for incoming messages. A flaw in the policy validation logic allows an attacker to bypass input validation checks, potentially permitting forged or spoofed email messages to pass authentication checks. An attacker can exploit this remotely without authentication to compromise email security controls.

Technologies: Trusted Domain Project OpenDMARC. Vendors: Trusted Domain Project.

Quick answers

Is CVE-2026-101015 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-101015 being exploited in the wild.
How severe is CVE-2026-101015?: High severity, with a CVSS score of 7.3, published 28 September 2026.
Which products and versions are affected?: Trusted Domain Project OpenDMARC up to 1.4.2.
Is there a fix for CVE-2026-101015?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-101015 attacked?: It is attacked over the network.
Am I affected by CVE-2026-101015?: Check whether you run Trusted Domain Project OpenDMARC at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an improper validation flaw in the policy.c file of OpenDMARC's Domain Handler component that fails to properly validate unsafe equivalence in input. The flaw can be triggered remotely via network-based attacks without authentication. A successful exploit results in bypassed DMARC validation, allowing unsafe equivalence conditions to circumvent email authentication controls.

Affected products

Trusted Domain Project OpenDMARC up to 1.4.2

Timeline

2026-09-28: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.