CVE-2026-126610: Progressive Robot hMailServer TLS CA file bypass

CVE-2026-126610 · Severity: high · CVSS 7.4 · Published 2026-11-11

hMailServer is a mail server application that can use MySQL or MariaDB as its database. When configured with certificate verification enabled and a CA file containing non-ASCII characters in its filename, the server fails to pass the CA file to the database client, allowing an attacker positioned between the mail server and database to intercept and modify database traffic or steal credentials. This affects versions 6.3.4 through 6.3.7 on systems where the database client has also been affected by related vulnerabilities.

Technologies: Progressive Robot hMailServer. Vendors: Mariadb, Progressive Robot.

Quick answers

Is CVE-2026-126610 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-126610 being exploited in the wild.
How severe is CVE-2026-126610?
High severity, with a CVSS score of 7.4, published 11 November 2026.
Which products and versions are affected?
Mariadb Connector/C 3.4.1 to 3.4.10; Progressive Robot hMailServer 6.3.4 through 6.3.7.
Is there a fix for CVE-2026-126610?
Yes: fixed in hMailServer 6.3.8 or later; MariaDB Connector/C 3.4.11 or later. Until then: Ensure the TlsCaFile path contains only ASCII characters (or characters within U+00FF on Windows) to avoid the filename encoding issue. Update MariaDB Connector/C to version 3.4.11 or later, and update hMailServer to 6.3.8 or later once available. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-126610 attacked?
It is attacked over the network or from the adjacent network, in a hosted service.
Am I affected by CVE-2026-126610?
Check whether you run Mariadb Connector/C or Progressive Robot hMailServer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: hMailServer 6.3.8 or later; MariaDB Connector/C 3.4.11 or later

Ensure the TlsCaFile path contains only ASCII characters (or characters within U+00FF on Windows) to avoid the filename encoding issue. Update MariaDB Connector/C to version 3.4.11 or later, and update hMailServer to 6.3.8 or later once available.

Technical details

hMailServer fails to pass the configured CA certificate file to the MariaDB/MySQL database client when the CA filename contains non-ASCII characters (outside ASCII on Linux, or above U+00FF on Windows), due to incorrect character encoding conversion in the C locale. The client then attempts certificate verification against the system trust store instead of the configured CA, enabling man-in-the-middle attacks. MariaDB Connector/C 3.4.1–3.4.10 compounds this by accepting self-signed certificates without proper issuer or name verification on both network and local connections, and in certain configurations allowing password compromise.

Affected products

  • Progressive Robot hMailServer 6.3.4 through 6.3.7
  • MariaDB Connector/C 3.4.1 to 3.4.10

Timeline

  • 2026-11-11: advisory

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.