# CVE-2026-24031: Dovecot SQL authentication bypass via cleared auth_username_chars

Source: https://junglewise.ai/threats/cve-2026-24031-dovecot-sql-authentication-bypass-via-cleared-auth-username-chars  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-27. Updated: 2026-06-30  
License: CC BY 4.0 with a link back

CVE-2026-24031 · Severity: high · CVSS 7.7 · Published 2026-03-27

Dovecot, a widely used email server, contains a security flaw in its authentication system when configured to use SQL databases. If a specific configuration setting is disabled by an administrator, attackers can bypass password requirements to log into any user account or discover valid email addresses. This could lead to unauthorized access to sensitive emails and a total compromise of user mailboxes.

Technologies: [Dovecot](https://junglewise.ai/threats/technologies/dovecot), [Red Hat Enterprise Linux 6](https://junglewise.ai/threats/technologies/enterprise-linux-6). Vendors: [Dovecot](https://junglewise.ai/threats/vendors/dovecot), [Open-Xchange](https://junglewise.ai/threats/vendors/open-xchange), [Red Hat](https://junglewise.ai/threats/vendors/red-hat).

## Quick answers

**Is CVE-2026-24031 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-24031 being exploited in the wild.

**How severe is CVE-2026-24031?** High severity, with a CVSS score of 7.7, published 27 March 2026.

**Which products and versions are affected?** Open-Xchange OX Dovecot Pro up to (excluding) 3.1.4; Red Hat Enterprise Linux 6 affected.

**Is there a fix for CVE-2026-24031?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-24031 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-24031?** Check whether you run Dovecot, Open-Xchange OX Dovecot Pro or Red Hat Enterprise Linux 6 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A SQL injection vulnerability (CWE-89) exists in Dovecot's SQL-based authentication backend. The flaw is triggered when the 'auth_username_chars' configuration setting is explicitly cleared by an administrator, failing to properly neutralize special characters in the username field during the authentication query. A remote, unauthenticated attacker can exploit this to bypass authentication for any user or perform user enumeration. The vulnerability affects Dovecot CE versions prior to 2.4.3 and OX Dovecot Pro versions prior to 3.1.4. Administrators are advised to ensure 'auth_username_chars' is not empty or upgrade to a fixed version.

## Affected products

- Dovecot Dovecot CE up to (excluding) 2.4.3
- Open-Xchange OX Dovecot Pro up to (excluding) 3.1.4
- Red Hat Red Hat Enterprise Linux 6 affected

## Timeline

- 2026-03-27: disclosed
- 2026-03-27: advisory

## References

- [https://documentation.open-xchange.com/dovecot/security/advisories/csaf/2026/oxdc-adv-2026-0001.json](https://documentation.open-xchange.com/dovecot/security/advisories/csaf/2026/oxdc-adv-2026-0001.json)
- [https://access.redhat.com/security/cve/CVE-2026-24031](https://access.redhat.com/security/cve/CVE-2026-24031)
- [https://bugzilla.redhat.com/show_bug.cgi?id=2452181](https://bugzilla.redhat.com/show_bug.cgi?id=2452181)
- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-24031.json](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-24031.json)

## Related threats

- [Dovecot ManageSieve denial of service via malformed pre-auth command](https://junglewise.ai/threats/cve-2026-33605-dovecot-managesieve-denial-of-service-via-malformed-pre-auth)
- [Samba AD DC LDAP filter injection and ACL bypass in Compare requests](https://junglewise.ai/threats/cve-2026-58222-samba-ad-dc-ldap-filter-injection-and-acl-bypass-in-compare)
- [Samba KDC out-of-bounds read in kpasswd service](https://junglewise.ai/threats/cve-2026-58216-samba-kdc-out-of-bounds-read-in-kpasswd-service)
- [Samba internal DNS server denial of service via TKEY cache exhaustion](https://junglewise.ai/threats/cve-2026-58218-samba-internal-dns-server-denial-of-service-via-tkey-cache)
- [GStreamer gst-plugins-good heap out-of-bounds read in Matroska demuxer](https://junglewise.ai/threats/cve-2026-17072-gstreamer-gst-plugins-good-heap-out-of-bounds-read-in-matroska)