Quick answers
- Is CVE-2026-42008 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-42008 being exploited in the wild.
- How severe is CVE-2026-42008?
- Medium severity, with a CVSS score of 4.3, published 28 August 2026.
- Which products and versions are affected?
- Open-Xchange Dovecot Pro 2.3.0–2.3.22.1, 3.0.0–3.0.6, 3.1.0–3.1.5.
- Is there a fix for CVE-2026-42008?
- A patch was published on 2026-08-28: Patches available in versions 2.3.22.2, 3.0.7, and 3.1.6 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-42008 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-42008?
- Check whether you run Open-Xchange Dovecot Pro at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is an authentication bypass caused by insufficient separation of forwarding information from trusted proxies and Dovecot's internal authentication fields. An attacker controlling a host on the trusted proxy list can inject forged authentication field values that allow login as any user without password verification. The attack requires network access to Dovecot and the host must be already whitelisted as a trusted proxy; it does not affect deployments without trusted proxy configuration. The vulnerability exists in Dovecot versions 2.3.0–2.3.22.1, 3.0.0–3.0.6, and 3.1.0–3.1.5, with patches available in versions 2.3.22.2, 3.0.7, and 3.1.6 respectively.
Affected products
- Open-Xchange Dovecot Pro 2.3.0–2.3.22.1, 3.0.0–3.0.6, 3.1.0–3.1.5
Timeline
- 2026-08-28: disclosed
- 2026-08-28: patched: Patches available in versions 2.3.22.2, 3.0.7, and 3.1.6