# CVE-2026-41113: Sagredo qmail OS command injection in qmail-remote

Source: https://junglewise.ai/threats/cve-2026-41113-sagredo-qmail-os-command-injection-in-qmail-remote  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-16. Updated: 2026-05-19  
License: CC BY 4.0 with a link back

CVE-2026-41113 · Severity: high · CVSS 8.1 · Published 2026-04-16

Sagredo qmail is a modern distribution of the qmail mail server. A vulnerability in its TLS error handling allows an attacker to execute malicious commands on the mail server by sending an email from a specially configured domain. This could lead to a full system compromise or unauthorized access to email data.

## Quick answers

**Is CVE-2026-41113 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-41113 being exploited in the wild.

**How severe is CVE-2026-41113?** High severity, with a CVSS score of 8.1, published 16 April 2026.

**Which products and versions are affected?** sagredo-dev qmail v2024.10.26 through v2026.04.02.

**Is there a fix for CVE-2026-41113?** A patch was published on 2026-04-07: Fixed in version v2026.04.07 via commit 749f607 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-41113 attacked?** It is attacked over the network, in an operating system.

**Am I affected by CVE-2026-41113?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A command injection vulnerability exists in qmail-remote.c within the tls_quit() function. When the 'notlshosts_auto' feature is enabled, qmail-remote attempts to record hosts with failed TLS handshakes by executing a shell command via popen(). The command is constructed using sprintf() with the remote hostname (partner_fqdn) wrapped in single quotes. However, an attacker can bypass this by including single quotes and shell metacharacters (like backticks) in a DNS MX record. Because glibc's dn_expand() does not escape these characters, they are passed directly to the shell. An attacker who controls the DNS for a domain can achieve remote code execution as the qmailr user when the victim server attempts to deliver mail to that domain. This issue is fixed in version 2026.04.07.

## Affected products

- sagredo-dev qmail v2024.10.26 through v2026.04.02

## Timeline

- 2026-04-07: patched: Fixed in version v2026.04.07 via commit 749f607
- 2026-04-16: disclosed: Public disclosure and CVE assignment
- 2026-04-16: advisory

## References

- [https://blog.calif.io/p/we-asked-claude-to-audit-sagredos](https://blog.calif.io/p/we-asked-claude-to-audit-sagredos)
- [https://github.com/califio/publications/tree/main/MADBugs/qmail](https://github.com/califio/publications/tree/main/MADBugs/qmail)
- [https://github.com/sagredo-dev/qmail/commit/749f607f6885e3d01b36f2647d7a1db88f1ef741](https://github.com/sagredo-dev/qmail/commit/749f607f6885e3d01b36f2647d7a1db88f1ef741)
- [https://github.com/sagredo-dev/qmail/pull/42](https://github.com/sagredo-dev/qmail/pull/42)
- [https://github.com/sagredo-dev/qmail/releases/tag/v2026.04.07](https://github.com/sagredo-dev/qmail/releases/tag/v2026.04.07)
- [http://www.openwall.com/lists/oss-security/2026/04/18/5](http://www.openwall.com/lists/oss-security/2026/04/18/5)