Executive brief
Mailpit is an email and SMTP testing tool used by developers. A flaw in its internal IP address filtering allows attackers to craft malicious email messages with links that bypass security controls and reach internal network resources, including Azure cloud infrastructure, potentially exposing sensitive metadata and internal services.
Technical details
The vulnerability is a server-side request forgery (SSRF) flaw in Mailpit's IsInternalIP deny list function, which fails to block two categories of IP addresses: the Azure WireServer address 168.63.129.16 and IPv6-embedded IPv4 addresses using RFC 2765/6145 IPv4-translated prefixes. An attacker can embed hostnames resolving to these addresses in message content to reach Mailpit's link check API and proxy endpoint, bypassing intended internal network protections. The vulnerability requires network access to Mailpit's HTTP interface but does not require authentication. A fix addressing the deny list gaps is available.
Affected products
- axllent Mailpit <=1.31.0
Timeline
- 2026-09-02: disclosed