# CVE-2026-67448: Axllent Mailpit WebSocket origin check bypass via percent-encoded path

Source: https://junglewise.ai/threats/cve-2026-67448-axllent-mailpit-websocket-origin-check-bypass-via-percent-encoded  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-20. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-67448 · Severity: medium · CVSS 6.5 · Published 2026-08-20

Mailpit is a mail testing tool used by developers to capture and view emails during development. An attacker can trick a developer into visiting a malicious website while Mailpit is running, then use a URL encoding bypass to connect a WebSocket from that malicious site directly to Mailpit and read email metadata—including sender, recipient, subject line, and message preview—without authentication. This is a regression of a previously patched vulnerability.

Technologies: [Axllent Mailpit](https://junglewise.ai/threats/technologies/mailpit), [github.com/axllent/mailpit (Go)](https://junglewise.ai/threats/technologies/github-com-axllent-mailpit). Vendors: [Axllent](https://junglewise.ai/threats/vendors/axllent), [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2026-67448 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-67448 being exploited in the wild.

**How severe is CVE-2026-67448?** Medium severity, with a CVSS score of 6.5, published 20 August 2026.

**Which products and versions are affected?** Axllent Mailpit 1.29.0 through 1.30.5; github.com/axllent/mailpit (Go) >= 1.29.0, <= 1.30.5, SEMVER:introduced=1.29.0,fixed=1.30.6.

**Is there a fix for CVE-2026-67448?** Yes. github.com/axllent/mailpit (Go): upgrade to 1.30.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-67448 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-67448?** Check whether you run Axllent Mailpit or github.com/axllent/mailpit (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/axllent/mailpit (Go): upgrade to 1.30.6 or later

  ```sh
  go get github.com/axllent/mailpit@v1.30.6
  ```


## Technical details

The vulnerability is an origin validation bypass caused by a mismatch between security check logic and routing logic. Mailpit's server validates WebSocket origin requests by checking if the raw request URI starts with "/api/", but Go's ServeMux routes based on the percent-decoded path. By sending a request to /%61pi/events (where %61 decodes to "a"), the origin check is skipped entirely (since "/%61pi/events" does not start with "/api/"), but the router decodes it to /api/events and routes to the WebSocket handler. The WebSocket upgrader unconditionally accepts all origins. This affects versions 1.29.0 through 1.30.5 when running without UI authentication (the default). An unauthenticated, cross-origin attacker can establish a WebSocket connection and stream sensitive email data in real-time. The fix is to perform origin checks against the decoded URL path instead of the raw request URI, and ideally restore proper origin checking in the WebSocket upgrader itself.

## Affected products

- axllent Mailpit 1.29.0 through 1.30.5

## Identifiers

- CVE-2026-67448
- GHSA-8r62-w5wh-fc5m
- GO-2026-6271

## Timeline

- 2026-08-20: disclosed: Published to GitHub Advisory Database
- 2026-08-20: patched: Version 1.30.6 released with fix
- 2026-01-10: other: Original CVE-2026-22689 fixed by removing CheckOrigin (commit 6f1f4f3, v1.28.2)
- 2026-01-31: other: Regression introduced in v1.29.0 (commit a63bcd9) when reintroducing CheckOrigin and replacing protection with bypassable raw-prefix test

## References

- [https://api.github.com/users/arpitjain099](https://api.github.com/users/arpitjain099)
- [https://github.com/arpitjain099](https://github.com/arpitjain099)
- [https://api.github.com/users/arpitjain099/gists%7B/gist_id%7D](https://api.github.com/users/arpitjain099/gists%7B/gist_id%7D)
- [https://api.github.com/users/arpitjain099/repos](https://api.github.com/users/arpitjain099/repos)
- [https://avatars.githubusercontent.com/u/3242828?v=4](https://avatars.githubusercontent.com/u/3242828?v=4)
- [https://api.github.com/users/arpitjain099/events%7B/privacy%7D](https://api.github.com/users/arpitjain099/events%7B/privacy%7D)

## Related threats

- [Mailpit IsInternalIP SSRF bypass for Azure WireServer and RFC 2765/6145 IPv6](https://junglewise.ai/threats/cve-2026-84697-mailpit-isinternalip-ssrf-bypass-for-azure-wireserver-and-rfc)
- [Mailpit SMTP DATA reader unbounded line buffering denial of service](https://junglewise.ai/threats/cve-2026-67447-mailpit-smtp-data-reader-unbounded-line-buffering-denial-of)
- [Mailpit thumbnail generation unbounded image dimension decode](https://junglewise.ai/threats/cve-2026-67446-mailpit-thumbnail-generation-unbounded-image-dimension-decode)
- [Mailpit SMTP command parser unbounded buffering denial of service](https://junglewise.ai/threats/cve-2026-67445-mailpit-smtp-command-parser-unbounded-buffering-denial-of-service)
- [axllent Mailpit memory exhaustion DoS in multiple API endpoints](https://junglewise.ai/threats/cve-2026-48824-axllent-mailpit-memory-exhaustion-dos-in-multiple-api-endpoints)