Executive brief
Mailpit is a mail testing tool used by developers to capture and view emails during development. An attacker can trick a developer into visiting a malicious website while Mailpit is running, then use a URL encoding bypass to connect a WebSocket from that malicious site directly to Mailpit and read email metadata—including sender, recipient, subject line, and message preview—without authentication. This is a regression of a previously patched vulnerability.
Technical details
The vulnerability is an origin validation bypass caused by a mismatch between security check logic and routing logic. Mailpit's server validates WebSocket origin requests by checking if the raw request URI starts with "/api/", but Go's ServeMux routes based on the percent-decoded path. By sending a request to /%61pi/events (where %61 decodes to "a"), the origin check is skipped entirely (since "/%61pi/events" does not start with "/api/"), but the router decodes it to /api/events and routes to the WebSocket handler. The WebSocket upgrader unconditionally accepts all origins. This affects versions 1.29.0 through 1.30.5 when running without UI authentication (the default). An unauthenticated, cross-origin attacker can establish a WebSocket connection and stream sensitive email data in real-time. The fix is to perform origin checks against the decoded URL path instead of the raw request URI, and ideally restore proper origin checking in the WebSocket upgrader itself.
Affected products
- axllent Mailpit 1.29.0 through 1.30.5
Timeline
- 2026-08-20: disclosed: Published to GitHub Advisory Database
- 2026-08-20: patched: Version 1.30.6 released with fix
- 2026-01-10: other: Original CVE-2026-22689 fixed by removing CheckOrigin (commit 6f1f4f3, v1.28.2)
- 2026-01-31: other: Regression introduced in v1.29.0 (commit a63bcd9) when reintroducing CheckOrigin and replacing protection with bypassable raw-prefix test