CVE-2026-27851: Safe Filter Bypass SQLi Vulnerability

CVE-2026-27851 Overview

CVE-2026-27851 affects template processing logic where the safe filter, when combined with variable expansion, incorrectly propagates its trust marker to all subsequent pipeline stages on the same string. Downstream filters treat untrusted input as pre-sanitized, bypassing automatic escaping. The flaw is referenced in an Open-Xchange Dovecot security advisory and is classified under [CWE-235] (Improper Handling of Extra Parameters). Attackers can exploit this behavior to inject unescaped data into authentication queries, enabling SQL injection and LDAP injection where the affected templating is used for credential lookups. No public exploit code is currently available.

Critical Impact

Untrusted input flows unescaped into authentication queries, allowing SQL and LDAP injection against backend identity stores.

Affected Products

• Open-Xchange Dovecot (see vendor advisory for affected version ranges)
• Deployments using safe filter with variable expansion in authentication templates
• Configurations where filter pipelines process user-supplied authentication data

Discovery Timeline

• 2026-05-12 - CVE-2026-27851 published to NVD
• 2026-05-12 - Last updated in NVD database

Technical Details for CVE-2026-27851

Vulnerability Analysis

The vulnerability resides in the filter pipeline evaluator that processes templated strings. When the safe filter marks a value as trusted, the marker is intended to apply only to that filter's output. The implementation instead persists the safe state across the entire pipeline. Subsequent filters that operate on the same string inherit this marker and skip required escaping.

This flaw is exploitable when the templating engine constructs authentication queries from user-controlled input. An attacker supplying a crafted username or identifier can inject SQL fragments or LDAP search filter syntax that would normally be neutralized by automatic escaping. The result is authentication bypass or unauthorized data disclosure from identity backends.

Exploitation requires the vulnerable template configuration to include a safe filter applied to a variable that also passes through escaping filters. The attack complexity is elevated because the attacker must reach a code path where this pipeline pattern is used.

Root Cause

The trust marker assigned by the safe filter is not scoped to a single pipeline stage. The evaluator carries the safe flag forward, causing later escaping filters to short-circuit. Input that should have been escaped for SQL or LDAP contexts is passed through verbatim.

Attack Vector

The attack vector is network-based and requires no authentication. An attacker submits crafted input to an authentication endpoint that uses a vulnerable filter pipeline. The unescaped payload reaches the backend SQL database or LDAP directory, where injected syntax executes within the authentication query context. See the Open-Xchange Security Advisory for technical details.

Detection Methods for CVE-2026-27851

Indicators of Compromise

• Authentication logs containing SQL metacharacters such as single quotes, comment sequences, or UNION keywords in username fields
• LDAP query logs showing unexpected filter syntax including parentheses, asterisks, or boolean operators in user-supplied identifiers
• Repeated failed authentication attempts followed by anomalous successful logins from the same source
• Backend database or directory errors triggered by malformed authentication queries

Detection Strategies

• Audit template configurations for use of the safe filter in pipelines that also include escaping or query-construction filters
• Inspect authentication request payloads for injection patterns at the proxy or web application firewall layer
• Correlate authentication failures with backend SQL or LDAP error messages to identify probe activity

Monitoring Recommendations

• Enable verbose authentication logging on the Dovecot service and forward events to a centralized SIEM
• Alert on authentication attempts containing characters atypical for valid usernames in your environment
• Monitor LDAP and SQL backends for query syntax anomalies originating from the authentication service

How to Mitigate CVE-2026-27851

Immediate Actions Required

• Identify all template configurations that apply the safe filter to variable-expanded input used in authentication flows
• Remove the safe filter from authentication-related templates until patched versions are deployed
• Apply vendor-supplied updates as published in the Open-Xchange advisory once available for your version

Patch Information

Refer to the Open-Xchange Security Advisory for the fixed version and upgrade instructions. The vendor recommends avoiding the safe filter until upgrading to the corrected release.

Workarounds

• Replace safe filter usage with explicit per-context escaping filters in authentication templates
• Restrict the character set accepted in authentication identifiers at the application boundary
• Enforce parameterized queries and LDAP API escaping in any custom authentication backends

# Audit Dovecot configuration for vulnerable pipeline patterns
grep -rn "safe" /etc/dovecot/ | grep -E "%\{.*\|.*safe"