# CVE-2026-84697: Mailpit IsInternalIP SSRF bypass for Azure WireServer and RFC 2765/6145 IPv6

Source: https://junglewise.ai/threats/cve-2026-84697-mailpit-isinternalip-ssrf-bypass-for-azure-wireserver-and-rfc  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-02. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-84697 · Severity: medium · CVSS 5.3 · Published 2026-09-02

Mailpit is an email and SMTP testing tool used by developers. A flaw in its internal IP address filtering allows attackers to craft malicious email messages with links that bypass security controls and reach internal network resources, including Azure cloud infrastructure, potentially exposing sensitive metadata and internal services.

Technologies: [Axllent Mailpit](https://junglewise.ai/threats/technologies/mailpit). Vendors: [Axllent](https://junglewise.ai/threats/vendors/axllent).

## Quick answers

**Is CVE-2026-84697 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-84697 being exploited in the wild.

**How severe is CVE-2026-84697?** Medium severity, with a CVSS score of 5.3, published 2 September 2026.

**Which products and versions are affected?** Axllent Mailpit <=1.31.0.

**Is there a fix for CVE-2026-84697?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-84697 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-84697?** Check whether you run Axllent Mailpit at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a server-side request forgery (SSRF) flaw in Mailpit's IsInternalIP deny list function, which fails to block two categories of IP addresses: the Azure WireServer address 168.63.129.16 and IPv6-embedded IPv4 addresses using RFC 2765/6145 IPv4-translated prefixes. An attacker can embed hostnames resolving to these addresses in message content to reach Mailpit's link check API and proxy endpoint, bypassing intended internal network protections. The vulnerability requires network access to Mailpit's HTTP interface but does not require authentication. A fix addressing the deny list gaps is available.

## Affected products

- axllent Mailpit <=1.31.0

## Timeline

- 2026-09-02: disclosed

## References

- [https://github.com/axllent/mailpit](https://github.com/axllent/mailpit)
- [https://github.com/axllent/mailpit/blob/v1.31.0/internal/tools/net.go](https://github.com/axllent/mailpit/blob/v1.31.0/internal/tools/net.go)

## Related threats

- [Axllent Mailpit WebSocket origin check bypass via percent-encoded path](https://junglewise.ai/threats/cve-2026-67448-axllent-mailpit-websocket-origin-check-bypass-via-percent-encoded)
- [Mailpit thumbnail generation unbounded image dimension decode](https://junglewise.ai/threats/cve-2026-67446-mailpit-thumbnail-generation-unbounded-image-dimension-decode)
- [Mailpit SMTP command parser unbounded buffering denial of service](https://junglewise.ai/threats/cve-2026-67445-mailpit-smtp-command-parser-unbounded-buffering-denial-of-service)
- [axllent Mailpit memory exhaustion DoS in multiple API endpoints](https://junglewise.ai/threats/cve-2026-48824-axllent-mailpit-memory-exhaustion-dos-in-multiple-api-endpoints)
- [axllent Mailpit denial of service via unbounded message size](https://junglewise.ai/threats/cve-2026-45713-axllent-mailpit-denial-of-service-via-unbounded-message-size)