Executive brief
Mailpit, a tool used by developers to test email delivery and APIs, contains a security flaw in its link-checking feature. An attacker can send a specially crafted email that forces the tool to connect to internal company servers or cloud management interfaces that should be private. This could allow an unauthorized person to map out your internal network or access sensitive configuration data from cloud providers like AWS or Google Cloud.
Technical details
Mailpit's SSRF protection in 'internal/tools/net.go' (IsInternalIP) was found to be incomplete because it relied on Go's standard library 'net.IP' helpers, which do not account for various IPv6 transition mechanisms. Specifically, the filter failed to block IPv4-embedded-in-IPv6 forms such as NAT64, 6to4, IPv4-compatible IPv6, and ISATAP, as well as deprecated site-local (fec0::/10) and documentation (2001:db8::/32) prefixes. An attacker can exploit this by invoking the 'POST /api/v1/message/{ID}/link-check' endpoint with these IPv6 literals. This allows the 'safeDialContext' to connect to internal IPv4 destinations, including cloud metadata endpoints (169.254.169.254), potentially leading to information disclosure. The issue is resolved in version 1.30.2 by implementing explicit decoding for these IPv6 forms.
Affected products
- axllent Mailpit < 1.30.2
Timeline
- 2026-06-17: patched: Version 1.30.2 released with fix
- 2026-07-10: disclosed: CVE-2026-55187 published