# CVE-2026-42008: Open-Xchange Dovecot trusted proxy authentication bypass

Source: https://junglewise.ai/threats/cve-2026-42008-open-xchange-dovecot-trusted-proxy-authentication-bypass  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-28. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-42008 · Severity: medium · CVSS 4.3 · Published 2026-08-28

Dovecot is an email server that handles user authentication and message storage for organizations. A flaw in how Dovecot processes authentication requests from trusted proxies allows any proxy server on the trusted list to authenticate as any user without knowing their password, potentially granting unauthorized access to email accounts. This vulnerability only affects deployments that have configured trusted proxies and use password databases that support passwordless authentication.

Technologies: [Open-Xchange Dovecot Pro](https://junglewise.ai/threats/technologies/dovecot-pro). Vendors: [Open-Xchange](https://junglewise.ai/threats/vendors/open-xchange).

## Quick answers

**Is CVE-2026-42008 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-42008 being exploited in the wild.

**How severe is CVE-2026-42008?** Medium severity, with a CVSS score of 4.3, published 28 August 2026.

**Which products and versions are affected?** Open-Xchange Dovecot Pro 2.3.0–2.3.22.1, 3.0.0–3.0.6, 3.1.0–3.1.5.

**Is there a fix for CVE-2026-42008?** A patch was published on 2026-08-28: Patches available in versions 2.3.22.2, 3.0.7, and 3.1.6 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-42008 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-42008?** Check whether you run Open-Xchange Dovecot Pro at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an authentication bypass caused by insufficient separation of forwarding information from trusted proxies and Dovecot's internal authentication fields. An attacker controlling a host on the trusted proxy list can inject forged authentication field values that allow login as any user without password verification. The attack requires network access to Dovecot and the host must be already whitelisted as a trusted proxy; it does not affect deployments without trusted proxy configuration. The vulnerability exists in Dovecot versions 2.3.0–2.3.22.1, 3.0.0–3.0.6, and 3.1.0–3.1.5, with patches available in versions 2.3.22.2, 3.0.7, and 3.1.6 respectively.

## Affected products

- Open-Xchange Dovecot Pro 2.3.0–2.3.22.1, 3.0.0–3.0.6, 3.1.0–3.1.5

## Timeline

- 2026-08-28: disclosed
- 2026-08-28: patched: Patches available in versions 2.3.22.2, 3.0.7, and 3.1.6

## References

- [https://documentation.open-xchange.com/dovecot/security/advisories/csaf/2026/oxdc-adv-2026-0003.json](https://documentation.open-xchange.com/dovecot/security/advisories/csaf/2026/oxdc-adv-2026-0003.json)

## Related threats

- [Open-Xchange Dovecot stack exhaustion denial of service](https://junglewise.ai/threats/cve-2026-73209-open-xchange-dovecot-stack-exhaustion-denial-of-service)
- [Open-Xchange Dovecot OAuth2 token scope validation bypass](https://junglewise.ai/threats/cve-2026-73208-open-xchange-dovecot-oauth2-token-scope-validation-bypass)
- [Open-Xchange Dovecot denial of service via IMAP compression](https://junglewise.ai/threats/cve-2026-52687-open-xchange-dovecot-denial-of-service-via-imap-compression)
- [Open-Xchange Dovecot Sieve CPU resource accounting bypass](https://junglewise.ai/threats/cve-2026-52681-open-xchange-dovecot-sieve-cpu-resource-accounting-bypass)
- [Open-Xchange Dovecot denial of service via NUL byte in trusted proxy forwarding](https://junglewise.ai/threats/cve-2026-42395-open-xchange-dovecot-denial-of-service-via-nul-byte-in-trusted)