CVE-2026-55187: Mailpit Information Disclosure Vulnerability

CVE-2026-55187 Overview

CVE-2026-55187 is a Server-Side Request Forgery (SSRF) vulnerability in Mailpit, an email testing tool and API for developers. Versions prior to 1.30.2 ship an incomplete remediation for CVE-2026-27808. The tools.IsInternalIP deny-list in internal/tools/net.go relies on Go standard library helpers and fails to block IPv6 transition mechanisms and reserved prefixes. Attackers who can deliver email and invoke the Link Check API can coerce Mailpit into dialing internal destinations, including cloud metadata endpoints [CWE-918].

Critical Impact
An unauthenticated network attacker can map internal service reachability and probe cloud metadata endpoints through Mailpit's Link Check API, exposing infrastructure behind the host.

Affected Products

Mailpit versions prior to 1.30.2
Deployments exposing the POST /api/v1/message/{ID}/link-check endpoint
Environments where Mailpit accepts inbound email from untrusted senders

Discovery Timeline

2026-07-10 - CVE-2026-55187 published to NVD
2026-07-13 - Last updated in NVD database

Technical Details for CVE-2026-55187

Vulnerability Analysis

Mailpit exposes a Link Check API that fetches URLs discovered in received messages to validate them. To prevent SSRF, the safeDialContext path calls tools.IsInternalIP to reject private, loopback, and link-local destinations. The prior fix for CVE-2026-27808 relied on Go's net.IP classification helpers, which do not recognize several IPv6 transition and reserved address families.

An attacker who delivers an email containing crafted links, then triggers POST /api/v1/message/{ID}/link-check, causes Mailpit to dial addresses that resolve to internal networks. The API returns status codes and error strings, giving the attacker an oracle to enumerate reachable services on the host and adjacent networks.

Root Cause

The deny-list in internal/tools/net.go does not cover NAT64, 6to4, IPv4-compatible IPv6, ISATAP, the site-local fec0::/10 prefix, or the documentation 2001:db8::/32 prefix. Because Go's classification helpers do not flag these ranges as private or reserved, IsInternalIP returns false, allowing the dialer to complete connections to internal targets encoded in these formats.

Attack Vector

Exploitation requires network access to Mailpit's HTTP API and the ability to deliver a message. The attacker embeds a URL whose hostname resolves through an IPv6 transition prefix, for example a 6to4 or NAT64 address that maps to an internal IPv4 target such as 169.254.169.254. Invoking the link-check endpoint issues an outbound request from Mailpit. Response codes and connection errors leak whether the internal address is reachable, enabling metadata harvesting on cloud instances.

The vulnerability manifests in the safeDialContext code path. Refer to the GitHub Security Advisory GHSA-w4mc-hhc6-xp28 and the remediation commit for the corrected classification logic.

Detection Methods for CVE-2026-55187

Indicators of Compromise

Outbound connections from the Mailpit process to link-local, site-local, or cloud metadata addresses such as 169.254.169.254, fd00::/8, or fec0::/10.
HTTP access logs showing repeated POST /api/v1/message/{ID}/link-check requests correlated with newly received messages.
DNS queries from the Mailpit host resolving hostnames to 6to4 (2002::/16), NAT64 (64:ff9b::/96), or IPv4-mapped IPv6 addresses.

Detection Strategies

Inspect application logs for link-check invocations tied to messages containing IPv6-encoded URLs or literal bracketed addresses.
Alert when the Mailpit service establishes TCP connections to RFC1918, carrier-grade NAT, or cloud metadata ranges.
Baseline expected egress destinations for the Mailpit host and flag any outbound request to unusual IPv6 prefixes.

Monitoring Recommendations

Forward Mailpit HTTP logs and host network telemetry to a centralized analytics platform for correlation.
Enable egress firewall logging on the Mailpit host and review denies for reconnaissance patterns.
Track the version of Mailpit deployed across environments and alert when instances below 1.30.2 appear.

How to Mitigate CVE-2026-55187

Immediate Actions Required

Upgrade Mailpit to version 1.30.2 or later on all instances.
Restrict network access to the Mailpit API so that only trusted developers and CI systems can reach it.
Block outbound traffic from the Mailpit host to cloud metadata endpoints and internal management networks.

Patch Information

The issue is fixed in Mailpit 1.30.2. The patch expands IsInternalIP to reject IPv6 transition mechanisms and reserved prefixes before safeDialContext establishes a connection. Details are available in the v1.30.2 release notes and the fix commit.

Workarounds

Disable or firewall the POST /api/v1/message/{ID}/link-check endpoint until the upgrade is applied.
Run Mailpit inside a network namespace or container with egress limited to explicitly allowed external hosts.
On cloud instances, enforce IMDSv2 and block IMDS access from the Mailpit workload identity.

bash

# Configuration example: restrict Mailpit egress with iptables/ip6tables
iptables -A OUTPUT -m owner --uid-owner mailpit -d 169.254.169.254 -j DROP
ip6tables -A OUTPUT -m owner --uid-owner mailpit -d fec0::/10 -j DROP
ip6tables -A OUTPUT -m owner --uid-owner mailpit -d 2002::/16 -j DROP
ip6tables -A OUTPUT -m owner --uid-owner mailpit -d 64:ff9b::/96 -j DROP
ip6tables -A OUTPUT -m owner --uid-owner mailpit -d 2001:db8::/32 -j DROP