CVE-2026-41113: Sagredo qmail RCE Vulnerability

CVE-2026-41113 Overview

CVE-2026-41113 is a remote code execution vulnerability affecting sagredo qmail versions prior to 2026.04.07. The vulnerability exists due to unsafe use of the popen function in the notlshosts_auto function within qmail-remote.c, which allows remote attackers to execute arbitrary commands on vulnerable mail servers.

Critical Impact

Remote attackers can achieve arbitrary code execution on affected qmail mail servers through shell injection, potentially leading to complete system compromise.

Affected Products

• sagredo qmail versions before 2026.04.07

Discovery Timeline

• 2026-04-16 - CVE-2026-41113 published to NVD
• 2026-04-16 - Last updated in NVD database

Technical Details for CVE-2026-41113

Vulnerability Analysis

This vulnerability is classified as CWE-78 (Improper Neutralization of Special Elements used in an OS Command), commonly known as OS Command Injection. The flaw exists in the TLS error handling logic of qmail-remote, specifically in the notlshosts_auto function found in qmail-remote.c.

The vulnerability occurs when user-controlled input is passed to the popen function without proper sanitization. The popen function executes a shell command and creates a pipe for inter-process communication. When attacker-controlled data reaches this function without adequate validation, it enables shell metacharacter injection, allowing arbitrary command execution with the privileges of the qmail process.

The network-accessible nature of this vulnerability means that any system running a vulnerable version of sagredo qmail with TLS functionality enabled is potentially at risk. Successful exploitation could allow an attacker to execute arbitrary commands, install backdoors, exfiltrate data, or pivot to other systems on the network.

Root Cause

The root cause is the unsafe use of popen in the notlshosts_auto function within qmail-remote.c. The function fails to properly sanitize input before constructing shell commands, allowing specially crafted input containing shell metacharacters to break out of the intended command context and execute arbitrary code.

Attack Vector

An attacker can exploit this vulnerability remotely over the network by sending specially crafted data to the qmail server. When the TLS error handling code processes this malicious input through the notlshosts_auto function, the unsanitized data is passed to popen, triggering command injection. The attack requires no authentication or user interaction, though the attack complexity is considered high due to the specific conditions required for exploitation.

The security patch adds proper input validation and includes additional headers for secure string handling:

+#ifdef TLS
+#include <ctype.h>
+#include <string.h>
+#include <fcntl.h>
+#include <unistd.h>
+#include <stdio.h>
+#include <limits.h>
 #include <pwd.h>
+#endif
 #include <sys/types.h>
 #include <sys/socket.h>
 #include <netinet/in.h>

Source: GitHub Commit Details

Detection Methods for CVE-2026-41113

Indicators of Compromise

• Unusual outbound network connections from qmail processes
• Unexpected child processes spawned by qmail-remote
• Suspicious commands in process listings containing shell metacharacters like ;, |, &, or backticks
• Anomalous entries in mail server logs indicating TLS-related errors with malformed hostnames

Detection Strategies

• Monitor qmail-remote process activity for unexpected child process spawning or unusual command execution patterns
• Implement network intrusion detection rules to identify SMTP traffic containing shell injection payloads
• Deploy SentinelOne endpoint protection to detect and block command injection attempts in real-time
• Audit system logs for indicators of post-exploitation activity such as reverse shells or unauthorized file access

Monitoring Recommendations

• Enable verbose logging on qmail servers to capture TLS negotiation errors and connection metadata
• Configure SIEM alerts for suspicious process trees originating from mail transfer agent processes
• Implement file integrity monitoring on qmail configuration and binary files
• Monitor for unauthorized modifications to the qmail-remote.c source or compiled binaries

How to Mitigate CVE-2026-41113

Immediate Actions Required

• Upgrade sagredo qmail to version 2026.04.07 or later immediately
• If immediate patching is not possible, consider disabling TLS functionality temporarily as a risk mitigation measure
• Review system logs for evidence of exploitation attempts
• Conduct a security audit of mail server configurations and access controls

Patch Information

The vulnerability has been addressed in sagredo qmail version 2026.04.07. The fix includes proper input validation and sanitization before passing data to the popen function. Administrators should apply this update as soon as possible.

Relevant security resources:

• GitHub Release Notes
• GitHub Pull Request
• GitHub Commit Details
• California Blog Post - Additional technical analysis
• GitHub Publication on MADBugs

Workarounds

• Temporarily disable TLS support in qmail-remote if upgrading is not immediately feasible
• Implement network-level filtering to restrict SMTP connections to trusted sources only
• Deploy a web application firewall or mail gateway that can inspect and sanitize SMTP traffic
• Consider running qmail in a containerized or sandboxed environment to limit the impact of potential exploitation

# Verify your qmail version and update to patched release
cd /path/to/qmail-source
git fetch --tags
git checkout v2026.04.07
make clean
make
make setup check