CVE-2026-54203: TeamDavid Webbox Information Disclosure

CVE-2026-54203 Overview

CVE-2026-54203 is a memory leak vulnerability in Tobit Laboratories AG TeamDavid's Webbox component. The flaw exposes raw application memory when clients request the URL path /.well-known/mta-sts.. An unauthenticated attacker can repeatedly poll the endpoint and harvest sensitive data returned from server memory, including user passwords. The issue is classified under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor. The vulnerability affects TeamDavid through Rollout 524. Full technical analysis is available in the Infoguard CVE Analysis.

Critical Impact
Unauthenticated attackers can extract sensitive information, including user passwords, directly from server memory over the network by repeatedly requesting a single URL.

Affected Products

Tobit Laboratories AG TeamDavid (Webbox component)
TeamDavid through Rollout 524
David groupware and messaging platform deployments

Discovery Timeline

2026-08-07 - CVE-2026-54203 published to NVD
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-54203

Vulnerability Analysis

The Webbox HTTP service in TeamDavid mishandles requests to the /.well-known/mta-sts. endpoint. Instead of returning either a properly formatted MTA-STS policy document or a 404 Not Found response, the application returns fragments of process memory in the HTTP response body.

This behavior maps to CWE-200, Exposure of Sensitive Information to an Unauthorized Actor. Because the endpoint is unauthenticated and reachable over the network, an attacker can script a loop that requests the URL thousands of times and store each response. The aggregated dumps yield credential material, session data, and other secrets held in the server's address space.

Root Cause

The root cause is an uninitialized or improperly bounded response buffer in the handler for .well-known paths ending in a trailing dot. The handler appears to allocate a memory region for the response body without zeroing it and without correctly setting the content length. The server then transmits stale heap contents to the client. Similar defects historically stem from missing input validation on URL suffixes combined with unsafe use of length-prefixed buffer APIs.

Attack Vector

Exploitation requires only network reachability to the Webbox HTTP interface. No authentication, no user interaction, and no prior foothold are required. An attacker issues repeated GET requests to /.well-known/mta-sts. and parses the returned byte stream for ASCII strings, credential patterns, and session identifiers. Because each response can leak a different memory region, repeated polling increases the volume of harvested data.

For complete exploitation details and proof-of-concept behavior, refer to the Infoguard CVE Analysis.

Detection Methods for CVE-2026-54203

Indicators of Compromise

Repeated HTTP GET requests to /.well-known/mta-sts. (note the trailing dot) from a single source IP within a short time window.
Webbox access log entries returning 200 OK for /.well-known/mta-sts. with non-standard or binary response sizes.
Outbound egress of unusually large volumes of data from the TeamDavid server to a client IP that only touched the .well-known path.

Detection Strategies

Deploy a web application firewall or reverse proxy rule that logs and alerts on any request path matching /.well-known/mta-sts. with a trailing dot.
Baseline normal MTA-STS request patterns, which should be low-volume from mail servers, and alert on spikes exceeding that baseline.
Inspect HTTP response bodies for /.well-known/mta-sts. and flag any response that is not a valid MTA-STS policy document or a 404 status.

Monitoring Recommendations

Enable verbose HTTP access logging on Webbox and forward logs to a SIEM for correlation.
Monitor authentication logs for password-spray or credential-stuffing activity following any observed probing of the .well-known endpoint.
Track TeamDavid version and Rollout number in asset inventory to identify hosts still exposed at Rollout 524 or earlier.

How to Mitigate CVE-2026-54203

Immediate Actions Required

Upgrade TeamDavid to a Rollout newer than 524 as published in the Tobit Release Notes.
Restrict network access to the Webbox HTTP interface using firewall rules or VPN gating until patching is complete.
Rotate all TeamDavid user passwords and any service credentials that may have been resident in server memory.

Patch Information

Tobit Laboratories AG addresses the vulnerability in versions of TeamDavid released after Rollout 524. Administrators should consult the Tobit Release Notes for the specific fixed Rollout and apply the update through the standard TeamDavid update mechanism. Verify successful installation by confirming the reported Rollout version in the administrative console after the upgrade.

Workarounds

Block all HTTP requests to paths matching /.well-known/mta-sts. at an upstream reverse proxy or WAF until the patch is applied.
Disable the Webbox component if MTA-STS functionality is not required for the deployment.
Force the reverse proxy to return 404 Not Found for /.well-known/mta-sts. and any variant with a trailing dot.

bash

# Example nginx rule to block the vulnerable endpoint
location ~ "^/\.well-known/mta-sts\.?$" {
    return 404;
    access_log /var/log/nginx/cve-2026-54203-block.log;
}