CVE-2026-40871: Mailcow Dockerized SQL Injection Flaw

CVE-2026-40871 Overview

CVE-2026-40871 is a second-order SQL injection vulnerability in mailcow: dockerized, an open source groupware/email suite based on Docker. Versions prior to 2026-03b are affected by this vulnerability, which allows attackers with API access to inject arbitrary SQL through the quarantine_category field via the Mailcow API. The vulnerability is particularly dangerous because it is a delayed (second-order) injection that executes when the quarantine notification job runs, potentially allowing exfiltration of sensitive data including admin credentials.

Critical Impact

Attackers can exfiltrate sensitive data such as admin credentials through UNION SELECT payloads rendered inside quarantine notification emails.

Affected Products

• mailcow: dockerized versions prior to 2026-03b

Discovery Timeline

• 2026-04-21 - CVE CVE-2026-40871 published to NVD
• 2026-04-22 - Last updated in NVD database

Technical Details for CVE-2026-40871

Vulnerability Analysis

This vulnerability stems from improper input validation (CWE-20) in the mailcow API. The /api/v1/add/mailbox endpoint accepts a quarantine_category parameter that is stored in the database without proper validation or sanitization. While this initial storage does not directly trigger the vulnerability, the stored value is later retrieved and used by the quarantine_notify.py script.

The critical flaw occurs when quarantine_notify.py constructs SQL queries using unsafe % string formatting instead of parameterized queries. This design pattern creates a second-order SQL injection scenario where the malicious payload remains dormant until the quarantine notification job executes. When triggered, an attacker-controlled SQL payload can manipulate database queries to extract sensitive information.

Using a UNION SELECT technique, attackers can craft payloads that exfiltrate sensitive data such as admin credentials. This data is then rendered directly inside quarantine notification emails, providing an exfiltration channel that bypasses traditional database monitoring.

Root Cause

The root cause is twofold: first, the /api/v1/add/mailbox endpoint fails to validate or sanitize the quarantine_category input before storing it in the database. Second, the quarantine_notify.py script uses unsafe string formatting (% operator) to construct SQL queries instead of using parameterized queries or prepared statements. This combination allows stored malicious input to be executed as SQL code during the notification job.

Attack Vector

The attack is network-based and requires authenticated API access with high privileges. An attacker must have the ability to create or modify mailbox entries through the Mailcow API. The attack flow involves:

1. Submitting a malicious SQL payload as the quarantine_category value via the /api/v1/add/mailbox endpoint
2. The payload is stored in the database without sanitization
3. When the quarantine notification job runs, quarantine_notify.py retrieves and incorporates the malicious value into SQL queries using unsafe string formatting
4. The injected SQL executes, and extracted data is embedded into quarantine notification emails
5. The attacker receives the exfiltrated data through the notification email content

The vulnerability mechanism exploits unsafe SQL query construction in the quarantine notification system. The quarantine_notify.py script uses Python's % string formatting operator to build SQL queries dynamically, incorporating the stored quarantine_category value directly into the query string. This allows attackers to break out of the intended query context and inject additional SQL commands. For complete technical details, see the GitHub Security Advisory.

Detection Methods for CVE-2026-40871

Indicators of Compromise

• Unusual or suspicious values in the quarantine_category field containing SQL syntax such as UNION, SELECT, --, or single quotes
• Quarantine notification emails containing unexpected database content or credential information
• API logs showing mailbox creation or modification requests with abnormally long or encoded quarantine_category values

Detection Strategies

• Monitor API request logs for the /api/v1/add/mailbox endpoint and flag requests containing SQL injection patterns in the quarantine_category parameter
• Implement database query logging and alert on queries originating from quarantine_notify.py that contain unexpected UNION or SELECT statements
• Review quarantine notification email content for anomalous data that may indicate successful data exfiltration

Monitoring Recommendations

• Enable detailed logging for the Mailcow API and database connections
• Set up alerts for failed or unusual SQL queries in the context of quarantine notification processing
• Periodically audit the quarantine_category values stored in the database for injection patterns

How to Mitigate CVE-2026-40871

Immediate Actions Required

• Upgrade mailcow: dockerized to version 2026-03b or later immediately
• Audit existing quarantine_category values in the database for malicious SQL patterns
• Review quarantine notification emails sent prior to patching for signs of data exfiltration
• Restrict API access to trusted administrators only until the patch is applied

Patch Information

Version 2026-03b of mailcow: dockerized addresses this vulnerability by implementing proper input validation and sanitization for the quarantine_category field, and by updating quarantine_notify.py to use parameterized queries instead of unsafe string formatting. Users should upgrade to this version or later. For additional details, refer to the GitHub Security Advisory.

Workarounds

• If immediate patching is not possible, implement application-level input validation to reject quarantine_category values containing SQL metacharacters
• Disable or restrict access to the /api/v1/add/mailbox API endpoint until the patch can be applied
• Temporarily disable quarantine notification emails to prevent execution of any stored malicious payloads

# Update mailcow to patched version
cd /opt/mailcow-dockerized
./update.sh