CVE-2026-45709: Mailpit SSRF Vulnerability

CVE-2026-45709 Overview

CVE-2026-45709 is a Server-Side Request Forgery (SSRF) vulnerability [CWE-918] in Mailpit, an email testing tool and API for developers. The flaw exists in the internal/htmlcheck/css.go module prior to version 1.30.0. It represents an incomplete fix for the earlier CVE-2026-23845 advisory. The newSafeHTTPClient function builds an http.Client whose Transport.DialContext calls net.Dialer.DialContext directly with no IP allowlisting. Attackers can force the server to dial loopback, private, link-local, and other reserved ranges. In default Mailpit deployments without UI or SMTP authentication, this becomes an unauthenticated, network-reachable SSRF.

Critical Impact
Unauthenticated attackers can send an HTML email and trigger one API call to force Mailpit into contacting arbitrary internal network resources, including loopback and private IP ranges.

Affected Products

Mailpit versions prior to 1.30.0
Mailpit v1.28.3 through v1.29.x (introduced by the incomplete fix for CVE-2026-23845)
Default Mailpit deployments exposing ports 1025 (SMTP) and 8025 (HTTP)

Discovery Timeline

2026-07-20 - CVE-2026-45709 published to NVD
2026-07-21 - Last updated in NVD database

Technical Details for CVE-2026-45709

Vulnerability Analysis

Mailpit's HTML Check API fetches external CSS stylesheets referenced in email content. The prior fix for CVE-2026-23845 added a 5MB size cap, a text/css content-type check, credential stripping in isValidURL, and an opt-in --block-remote-css-and-fonts flag. However, it did not add the IP-filtering dialer that Mailpit already uses on its proxy handler and link-check endpoints. The mis-named newSafeHTTPClient function creates a client whose transport dials any resolved address without restriction.

An attacker sends an HTML email containing a crafted <link> or @import reference. The attacker then issues a single HTTP GET to /api/v1/message/{id}/html-check. Mailpit fetches the URL server-side and returns success as long as the target replies with HTTP/200 and a text/css content-type. The CheckRedirect handler follows redirects to any URL passing isValidURL, without applying IP filtering.

Root Cause

The root cause is missing IP allowlist enforcement in the HTTP client's dialer. The Transport.DialContext field wraps net.Dialer.DialContext directly instead of a safe dialer that rejects loopback (127.0.0.0/8), private (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), link-local (169.254.0.0/16), and other reserved ranges. Sister endpoints in the same codebase already implemented this control.

Attack Vector

A remote unauthenticated attacker sends an HTML email to a Mailpit inbox using SMTP on port 1025. The email body embeds a stylesheet URL pointing to an attacker-controlled server. The attacker triggers the html-check API endpoint on port 8025. The attacker-controlled server responds with an HTTP redirect to an internal target such as http://127.0.0.1:8500/ or http://169.254.169.254/latest/meta-data/, then returns a minimal text/css payload to satisfy validation. Mailpit's response leaks whether the internal target is reachable and any CSS-shaped data it returned.

See the GitHub Security Advisory GHSA-j3fj-qppj-fmmc for additional technical details.

Detection Methods for CVE-2026-45709

Indicators of Compromise

Unexpected outbound HTTP requests from the Mailpit host to loopback, RFC 1918, or link-local addresses following inbound SMTP traffic on port 1025.
HTTP access logs showing repeated GET /api/v1/message/{id}/html-check requests from untrusted sources.
HTTP redirect chains in Mailpit's outbound traffic terminating at internal service ports such as 169.254.169.254, 127.0.0.1, or metadata endpoints.
SMTP messages containing <link rel="stylesheet"> or @import directives pointing to unfamiliar external domains.

Detection Strategies

Inspect Mailpit process network activity for connections to non-routable or internal address ranges after receiving inbound mail.
Correlate inbound SMTP submissions with subsequent html-check API calls originating from the same client IP within a short window.
Alert on HTTP redirects observed from the Mailpit process where the final destination resolves to a private or reserved IP range.

Monitoring Recommendations

Log all requests to /api/v1/message/*/html-check including source IP, user agent, and response size.
Monitor DNS resolutions performed by the Mailpit process for hostnames that resolve to internal IP space.
Track version banners across Mailpit deployments to identify hosts still running versions below 1.30.0.

How to Mitigate CVE-2026-45709

Immediate Actions Required

Upgrade Mailpit to version 1.30.0 or later, which contains the corrected IP-filtering dialer.
Restrict network access to Mailpit HTTP (8025) and SMTP (1025) ports to trusted development networks only.
Enable authentication on both the UI and SMTP interfaces to prevent unauthenticated triggering of the vulnerable endpoint.
Enable the --block-remote-css-and-fonts flag to prevent remote CSS fetching entirely where the feature is not required.

Patch Information

Upgrade to Mailpit v1.30.0. The release adds IP allowlist enforcement to the newSafeHTTPClient dialer, aligning it with the safe dialer used by the proxy handler and link-check endpoints. Redirect handling now applies the same IP filtering. Full release details are available in the GitHub Mailpit Release Notes.

Workarounds

Deploy Mailpit behind a network policy that blocks egress to loopback, RFC 1918, link-local, and cloud metadata addresses.
Run Mailpit in an isolated container or network namespace with no route to sensitive internal services.
Disable the HTML Check feature or restrict access to the /api/v1/message/{id}/html-check endpoint via a reverse proxy ACL until patching is complete.

bash

# Configuration example: restrict Mailpit egress and disable remote CSS fetching
docker run -d \
  --name mailpit \
  --network mailpit-isolated \
  -p 127.0.0.1:8025:8025 \
  -p 127.0.0.1:1025:1025 \
  axllent/mailpit:1.30.0 \
  --block-remote-css-and-fonts \
  --ui-auth user:$2a$14$... \
  --smtp-auth user:$2a$14$...