Is CVE-2026-101278 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-101278 being exploited in the wild.

How severe is CVE-2026-101278?

Medium severity, with a CVSS score of 4.3, published 29 September 2026.

Which products and versions are affected?

Trusted Domain Project OpenDMARC up to 1.4.2.

Is there a fix for CVE-2026-101278?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-101278 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-101278?

Check whether you run Trusted Domain Project OpenDMARC at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-101278: Trusted Domain Project OpenDMARC origin validation error in PSL Wildcard Handler

CVE-2026-101278 · Severity: medium · CVSS 4.3 · Published 2026-09-29

OpenDMARC is a library used to validate DMARC email authentication records. A flaw in how it handles public suffix list wildcards can bypass domain validation checks, allowing an attacker to forge emails that appear to come from legitimate domains. This could enable phishing attacks or email spoofing against organizations relying on DMARC verification.

Technologies: Trusted Domain Project OpenDMARC. Vendors: Trusted Domain Project.

Quick answers

Is CVE-2026-101278 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-101278 being exploited in the wild.
How severe is CVE-2026-101278?: Medium severity, with a CVSS score of 4.3, published 29 September 2026.
Which products and versions are affected?: Trusted Domain Project OpenDMARC up to 1.4.2.
Is there a fix for CVE-2026-101278?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-101278 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-101278?: Check whether you run Trusted Domain Project OpenDMARC at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The opendmarc_get_tld function in libopendmarc/opendmarc_tld.c fails to properly validate origins when processing public suffix list wildcards, resulting in an origin validation bypass. The vulnerability is remotely exploitable and requires no authentication or user interaction. An attacker can craft malicious DMARC records to circumvent domain origin checks.

Affected products

Trusted Domain Project OpenDMARC up to 1.4.2

Timeline

2026-09-29: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.