CVE-2026-22689: Mailpit WebSocket Hijacking Vulnerability

CVE-2026-22689 Overview

A Cross-Site WebSocket Hijacking (CSWSH) vulnerability has been identified in Mailpit, a popular email testing tool and API used by developers. Prior to version 1.28.2, the Mailpit WebSocket server is configured to accept connections from any origin due to a lack of Origin header validation. This vulnerability allows an attacker to host a malicious website that, when visited by a developer running Mailpit locally, establishes a WebSocket connection to the victim's Mailpit instance (default ws://localhost:8025). Through this attack vector, sensitive data such as email contents, headers, and server statistics can be intercepted in real-time.

Critical Impact

Attackers can intercept sensitive email data including contents, headers, and server statistics from developers running Mailpit locally by exploiting the permissive WebSocket origin policy.

Affected Products

• Mailpit versions prior to 1.28.2
• Developer environments running Mailpit on default configuration (localhost:8025)
• Any deployment where Mailpit WebSocket interface is accessible without Origin validation

Discovery Timeline

• January 10, 2026 - CVE-2026-22689 published to NVD
• January 13, 2026 - Last updated in NVD database

Technical Details for CVE-2026-22689

Vulnerability Analysis

This vulnerability stems from improper WebSocket configuration in Mailpit's server implementation. The WebSocket upgrader was explicitly configured to bypass origin checking, accepting connections from any domain. This is a classic Cross-Site WebSocket Hijacking (CSWSH) vulnerability pattern (CWE-1385) that allows malicious websites to establish WebSocket connections to a victim's local Mailpit instance.

When a developer visits an attacker-controlled website while running Mailpit locally, the malicious page can initiate a WebSocket connection to ws://localhost:8025. Because the server accepts all origins, this connection is established successfully. The attacker's JavaScript can then receive all real-time data pushed through the WebSocket, including email contents, headers, and server statistics meant only for the legitimate local user.

Root Cause

The root cause is the permissive CheckOrigin function in the WebSocket upgrader configuration. The server was explicitly configured with CheckOrigin: func(r *http.Request) bool { return true }, which unconditionally accepts WebSocket upgrade requests regardless of the Origin header. This design choice, likely intended to support multi-domain development scenarios, inadvertently created a significant security vulnerability by disabling a critical security control.

Attack Vector

The attack requires user interaction—specifically, a developer must visit a malicious website while running Mailpit locally. The attack flow involves:

1. Attacker hosts a malicious website containing JavaScript that attempts WebSocket connections to common localhost ports
2. Developer visits the malicious site while Mailpit is running locally
3. The malicious JavaScript establishes a WebSocket connection to ws://localhost:8025
4. Without origin validation, Mailpit accepts the connection
5. Attacker's script receives all real-time email data and server statistics

The following code shows the vulnerable configuration and the security patch applied:

 var upgrader = websocket.Upgrader{
 	ReadBufferSize:    1024,
 	WriteBufferSize:   1024,
-	CheckOrigin:       func(r *http.Request) bool { return true }, // allow multi-domain
-	EnableCompression: true,                                       // experimental compression
+	EnableCompression: true,
 }
 
 // Client is a middleman between the websocket connection and the hub.

Source: GitHub Commit Details

Detection Methods for CVE-2026-22689

Indicators of Compromise

• Unexpected WebSocket connections to Mailpit from non-localhost origins
• Browser developer console showing WebSocket connections initiated from unfamiliar domains to localhost:8025
• Network traffic logs indicating cross-origin WebSocket upgrade requests to Mailpit endpoints
• Unexplained access patterns or data exfiltration from local development environments

Detection Strategies

• Monitor WebSocket connection logs for connections originating from external or unexpected origins
• Implement browser extensions or network monitoring tools to alert on localhost WebSocket connections from external sites
• Review Mailpit access logs for suspicious connection patterns or high-frequency data access
• Use Content Security Policy (CSP) headers in development environments to restrict WebSocket connections

Monitoring Recommendations

• Enable verbose logging on Mailpit instances to track WebSocket connection origins
• Implement network-level monitoring for unexpected localhost traffic patterns in development environments
• Regularly audit development tool configurations for overly permissive security settings
• Consider using endpoint detection solutions that can identify anomalous localhost communication patterns

How to Mitigate CVE-2026-22689

Immediate Actions Required

• Upgrade Mailpit to version 1.28.2 or later immediately
• Audit any custom WebSocket configurations for similar permissive origin policies
• Review browser history and network logs for signs of exploitation if running vulnerable versions
• Consider temporarily disabling Mailpit's WebSocket functionality until patched

Patch Information

This vulnerability has been patched in Mailpit version 1.28.2. The fix removes the permissive CheckOrigin function that unconditionally returned true, defaulting to the standard origin checking behavior which validates that the WebSocket connection originates from an allowed origin. The patch is available in commit 6f1f4f34c98989fd873261018fb73830b30aec3f. For detailed information, refer to the GitHub Security Advisory GHSA-524m-q5m7-79mm.

Workarounds

• Restrict network access to Mailpit by binding it to localhost only and ensuring no external network access
• Use a reverse proxy with proper origin validation in front of Mailpit's WebSocket endpoint
• Implement firewall rules to block external connections to Mailpit ports
• Consider running Mailpit in an isolated Docker container without host network access

# Configuration example - Run Mailpit with restricted binding
# Ensure Mailpit only listens on localhost interface
mailpit --listen 127.0.0.1:8025

# Alternatively, use Docker with isolated networking
docker run -d --name mailpit -p 127.0.0.1:8025:8025 axllent/mailpit:v1.28.2