Is CVE-2026-55187 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-55187 being exploited in the wild.

How severe is CVE-2026-55187?

Medium severity, with a CVSS score of 5.8, published 10 July 2026.

Which products and versions are affected?

Axllent Mailpit < 1.30.2, <= 1.30.1; github.com/axllent/mailpit (Go) <= 1.30.1, SEMVER:introduced=0,fixed=1.30.2.

Is there a fix for CVE-2026-55187?

Yes. github.com/axllent/mailpit (Go): upgrade to 1.30.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-55187 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-55187?

Check whether you run Axllent Mailpit or github.com/axllent/mailpit (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-55187: axllent Mailpit SSRF bypass in Link Check API via IPv6 transition forms

Q: Which products and versions are affected?

Axllent Mailpit < 1.30.2, <= 1.30.1; github.com/axllent/mailpit (Go) <= 1.30.1, SEMVER:introduced=0,fixed=1.30.2.

Q: Is there a fix for CVE-2026-55187?

Yes. github.com/axllent/mailpit (Go): upgrade to 1.30.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-55187 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-55187?

Check whether you run Axllent Mailpit or github.com/axllent/mailpit (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-55187 · Severity: medium · CVSS 5.8 · Published 2026-07-10

Mailpit, a tool used by developers to test email delivery and APIs, contains a security flaw in its link-checking feature. An attacker can send a specially crafted email that forces the tool to connect to internal company servers or cloud management interfaces that should be private. This could allow an unauthorized person to map out your internal network or access sensitive configuration data from cloud providers like AWS or Google Cloud.

Technologies: Axllent Mailpit, github.com/axllent/mailpit (Go). Vendors: Axllent, Go.

Quick answers

Is CVE-2026-55187 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-55187 being exploited in the wild.
How severe is CVE-2026-55187?: Medium severity, with a CVSS score of 5.8, published 10 July 2026.
Which products and versions are affected?: Axllent Mailpit < 1.30.2, <= 1.30.1; github.com/axllent/mailpit (Go) <= 1.30.1, SEMVER:introduced=0,fixed=1.30.2.
Is there a fix for CVE-2026-55187?: Yes. github.com/axllent/mailpit (Go): upgrade to 1.30.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-55187 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-55187?: Check whether you run Axllent Mailpit or github.com/axllent/mailpit (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/axllent/mailpit (Go): upgrade to 1.30.2 or later
```
go get github.com/axllent/mailpit@v1.30.2
```

Technical details

Mailpit's SSRF protection in 'internal/tools/net.go' (IsInternalIP) was found to be incomplete because it relied on Go's standard library 'net.IP' helpers, which do not account for various IPv6 transition mechanisms. Specifically, the filter failed to block IPv4-embedded-in-IPv6 forms such as NAT64, 6to4, IPv4-compatible IPv6, and ISATAP, as well as deprecated site-local (fec0::/10) and documentation (2001:db8::/32) prefixes. An attacker can exploit this by invoking the 'POST /api/v1/message/{ID}/link-check' endpoint with these IPv6 literals. This allows the 'safeDialContext' to connect to internal IPv4 destinations, including cloud metadata endpoints (169.254.169.254), potentially leading to information disclosure. The issue is resolved in version 1.30.2 by implementing explicit decoding for these IPv6 forms.

Affected products

axllent Mailpit < 1.30.2

Identifiers

CVE-2026-55187
GHSA-w4mc-hhc6-xp28
GO-2026-5688

Timeline

2026-06-17: patched: Version 1.30.2 released with fix
2026-07-10: disclosed: CVE-2026-55187 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.