CVE-2026-78061: TaxHacker Email Sync SSRF Vulnerability

CVE-2026-78061 Overview

CVE-2026-78061 is a Server-Side Request Forgery (SSRF) vulnerability in vas3k TaxHacker versions up to and including 0.8.2. The flaw resides in the buildImapConfig function within lib/email-sync/imap-client.ts, part of the Email Sync component. An authenticated attacker can manipulate the host and port arguments to force the application to issue requests to attacker-controlled or internal network destinations. The issue is exploitable remotely over the network and requires low privileges. At the time of publication, a pull request to remediate the vulnerability is pending acceptance upstream.

Critical Impact
Attackers can leverage the IMAP client to reach internal services, cloud metadata endpoints, or arbitrary external hosts, enabling reconnaissance and pivoting into otherwise unreachable network segments.

Affected Products

vas3k TaxHacker versions up to 0.8.2
Component: Email Sync (lib/email-sync/imap-client.ts)
Function: buildImapConfig

Discovery Timeline

2026-08-23 - CVE-2026-78061 published to NVD
2026-08-24 - Last updated in NVD database

Technical Details for CVE-2026-78061

Vulnerability Analysis

The vulnerability is classified as Server-Side Request Forgery under [CWE-918]. TaxHacker's Email Sync feature builds an IMAP client configuration from user-supplied parameters. The buildImapConfig function in lib/email-sync/imap-client.ts accepts host and port values without validating them against an allowlist or blocking access to internal address ranges.

When a low-privileged authenticated user submits crafted IMAP connection details, the server initiates outbound TCP connections to the attacker-specified destination. This allows the application to be repurposed as a request proxy. Typical SSRF outcomes include probing of internal services, interaction with cloud instance metadata endpoints, and bypass of perimeter firewalls that trust the application host.

Because the attack channel is IMAP rather than plain HTTP, exploitation relies on TCP-level interaction and error-message oracles rather than full HTTP response reflection. The confidentiality, integrity, and availability impacts are each limited but non-zero.

Root Cause

The root cause is missing input validation on the host and port arguments passed to buildImapConfig. The function does not enforce restrictions on private IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), loopback addresses, link-local addresses (169.254.0.0/16), or arbitrary ports outside standard IMAP service ports (143, 993).

Attack Vector

Exploitation requires network access to the TaxHacker application and a valid user account with permission to configure email synchronization. The attacker supplies a target host and port through the Email Sync configuration interface. TaxHacker then initiates a connection to that destination from the server's network context. Timing behavior and connection error responses can be used to enumerate internal services. Refer to the GitHub Issue #148 and Pull Request #170 for the technical fix discussion.

No verified public exploit code is available. The vulnerability mechanism is described in the referenced VulDB CVE-2026-78061 entry.

Detection Methods for CVE-2026-78061

Indicators of Compromise

Outbound TCP connections from the TaxHacker application host to internal RFC1918 addresses on non-IMAP ports.
Connection attempts from TaxHacker to cloud metadata endpoints such as 169.254.169.254.
Repeated Email Sync configuration changes by a single user account within a short interval, indicating enumeration.
Application logs showing IMAP connection failures against unusual hostnames or ports.

Detection Strategies

Instrument the TaxHacker host with egress network monitoring and alert on connections to private IP ranges from the application process.
Correlate Email Sync configuration events with subsequent outbound connections to detect abuse patterns.
Review reverse proxy and application logs for high-frequency IMAP configuration updates originating from a single session.

Monitoring Recommendations

Log all invocations of buildImapConfig with the resolved destination address and requesting user.
Enable DNS query logging on the application host to identify lookups for internal domains or metadata service hostnames.
Monitor for connections to non-standard ports that do not match IMAP service defaults (143, 993).

How to Mitigate CVE-2026-78061

Immediate Actions Required

Restrict access to the Email Sync configuration feature to trusted administrators until a patched release is available.
Deploy egress filtering on the TaxHacker host to block outbound traffic to internal networks, loopback, link-local, and cloud metadata addresses.
Audit existing Email Sync configurations for suspicious host values that do not correspond to legitimate mail servers.

Patch Information

A fix is proposed in Pull Request #170 against the upstream repository at vas3k/TaxHacker. At the time of NVD publication the pull request awaits acceptance. Operators should track the repository and upgrade to the first release that incorporates the merged fix.

Workarounds

Enforce a network egress allowlist that limits TaxHacker outbound connections to known IMAP providers on ports 143 and 993.
Run TaxHacker in a network namespace or container with no route to internal management networks or cloud metadata services.
Apply a reverse proxy or WAF rule that blocks Email Sync configuration payloads containing private IP literals or non-IMAP ports.

bash

# Configuration example: iptables egress restriction for the TaxHacker host
iptables -A OUTPUT -m owner --uid-owner taxhacker -d 169.254.169.254 -j REJECT
iptables -A OUTPUT -m owner --uid-owner taxhacker -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner taxhacker -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -m owner --uid-owner taxhacker -d 192.168.0.0/16 -j REJECT
iptables -A OUTPUT -m owner --uid-owner taxhacker -p tcp --dport 993 -j ACCEPT
iptables -A OUTPUT -m owner --uid-owner taxhacker -p tcp --dport 143 -j ACCEPT