# CVE-2026-85751: Mailu mail server authentication bypass via header spoofing

Source: https://junglewise.ai/threats/cve-2026-85751-mailu-is-a-mail-server-distributed-as-a-set-of-docker-images-from  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-21. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-85751 · Severity: critical · CVSS 9.8 · Published 2026-09-21

Mailu is a mail server distributed as Docker images. When proxy authentication is enabled but misconfigured, attackers can spoof the X-Forwarded-By header to bypass authentication and gain unauthorized access to the mail server. This allows unauthenticated users to access email accounts and data without valid credentials.

Technologies: [Mailu](https://junglewise.ai/threats/technologies/mailu). Vendors: [Mailu](https://junglewise.ai/threats/vendors/mailu).

## Quick answers

**Is CVE-2026-85751 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-85751 being exploited in the wild.

**How severe is CVE-2026-85751?** Critical severity, with a CVSS score of 9.8, published 21 September 2026.

**Which products and versions are affected?** Mailu Helm-Charts prior to 2.7.3; Mailu 2.0 to 2024.06.54.

**Is there a fix for CVE-2026-85751?** A patch was published on 2024-06-55: Fixed in Mailu 2024.06.55 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-85751 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-85751?** Check whether you run Mailu Helm-Charts or Mailu at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in the nginx proxy configuration when PROXY_AUTH_WHITELIST is set but REAL_IP_HEADER is unset. The proxy_hide_header directive hides the X-Forwarded-By header in upstream responses but fails to overwrite or validate incoming client-controlled requests, allowing header spoofing. An unauthenticated remote attacker can send a crafted X-Forwarded-By header to impersonate a trusted proxy and bypass authentication.

## Affected products

- Mailu Mailu 2.0 to 2024.06.54
- Mailu helm-charts prior to 2.7.3

## Timeline

- 2026-09-21: disclosed
- 2024-06-55: patched: Fixed in Mailu 2024.06.55
- 2024-07: patched: Fixed in helm-charts 2.7.3

## References

- [https://github.com/Mailu/Mailu/commit/dffa97cbd889ab208246372ce9c86e99abb27ae9](https://github.com/Mailu/Mailu/commit/dffa97cbd889ab208246372ce9c86e99abb27ae9)
- [https://github.com/Mailu/Mailu/commit/ff4003d045753013470945336448dbd790cac778](https://github.com/Mailu/Mailu/commit/ff4003d045753013470945336448dbd790cac778)

## Related threats

- [Mailu domain manager email spoofing authorization bypass](https://junglewise.ai/threats/cve-2026-86009-mailu-is-a-mail-server-distributed-as-a-set-of-docker-images)
- [Mailu authorization bypass in admin account management](https://junglewise.ai/threats/cve-2026-86008-mailu-is-a-mail-server-distributed-as-a-set-of-docker-images)
- [Mailu admin REST API missing authentication in token endpoint](https://junglewise.ai/threats/cve-2026-49217-mailu-admin-rest-api-missing-authentication-in-token-endpoint)