# CVE-2026-27851: Open-Xchange Dovecot injection via unsafe variable expansion

Source: https://junglewise.ai/threats/cve-2026-27851-open-xchange-dovecot-injection-via-unsafe-variable-expansion  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-12. Updated: 2026-05-18  
License: CC BY 4.0 with a link back

CVE-2026-27851 · Severity: high · CVSS 7.4 · Published 2026-05-12

Open-Xchange Dovecot is a widely used email server. A vulnerability in how it processes certain data filters could allow attackers to bypass security protections during the login process. This could lead to unauthorized access to email accounts or the underlying database through injection attacks.

Technologies: [Dovecot](https://junglewise.ai/threats/technologies/dovecot), [Open-Xchange Dovecot CE](https://junglewise.ai/threats/technologies/dovecot-ce), [Open-Xchange Dovecot Pro](https://junglewise.ai/threats/technologies/dovecot-pro). Vendors: [Dovecot](https://junglewise.ai/threats/vendors/dovecot), [Open-Xchange](https://junglewise.ai/threats/vendors/open-xchange).

## Quick answers

**Is CVE-2026-27851 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-27851 being exploited in the wild.

**How severe is CVE-2026-27851?** High severity, with a CVSS score of 7.4, published 12 May 2026.

**Which products and versions are affected?** Open-Xchange Dovecot CE 2.4.0 through 2.4.3; Open-Xchange Dovecot Pro 2.3.0 through 3.1.4.

**Is there a fix for CVE-2026-27851?** A patch was published on 2026-05-05: Initial internal release of fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-27851 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-27851?** Check whether you run Dovecot, Open-Xchange Dovecot CE or Open-Xchange Dovecot Pro at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability exists in Dovecot's variable expansion mechanism where the use of the 'safe' filter incorrectly marks all subsequent pipelines on the same string as safe. This logic error allows unescaped, malicious data to be processed by the application. If these strings are used in authentication queries, an attacker can perform SQL or LDAP injection. The attack requires a specific configuration (use of the safe filter) and has high complexity, but can be executed remotely without prior authentication. Fixes are available in Dovecot Pro 3.1.5 and Dovecot CE 2.4.4.

## Affected products

- Open-Xchange Dovecot Pro 2.3.0 through 3.1.4
- Open-Xchange Dovecot CE 2.4.0 through 2.4.3

## Timeline

- 2026-03-29: other: Vulnerability discovered
- 2026-05-05: patched: Initial internal release of fix
- 2026-05-12: disclosed: Public advisory released

## References

- [https://documentation.open-xchange.com/dovecot/security/advisories/csaf/2026/oxdc-adv-2026-0002.json](https://documentation.open-xchange.com/dovecot/security/advisories/csaf/2026/oxdc-adv-2026-0002.json)

## Related threats

- [Open-Xchange Dovecot stack exhaustion denial of service](https://junglewise.ai/threats/cve-2026-73209-open-xchange-dovecot-stack-exhaustion-denial-of-service)
- [Open-Xchange Dovecot OAuth2 token scope validation bypass](https://junglewise.ai/threats/cve-2026-73208-open-xchange-dovecot-oauth2-token-scope-validation-bypass)
- [Open-Xchange Dovecot denial of service via IMAP compression](https://junglewise.ai/threats/cve-2026-52687-open-xchange-dovecot-denial-of-service-via-imap-compression)
- [Open-Xchange Dovecot Sieve CPU resource accounting bypass](https://junglewise.ai/threats/cve-2026-52681-open-xchange-dovecot-sieve-cpu-resource-accounting-bypass)
- [Open-Xchange Dovecot denial of service via NUL byte in trusted proxy forwarding](https://junglewise.ai/threats/cve-2026-42395-open-xchange-dovecot-denial-of-service-via-nul-byte-in-trusted)