CVE-2026-84642: Thunderbird SSRF Vulnerability

CVE-2026-84642 Overview

CVE-2026-84642 is a hostname validation flaw in Mozilla Thunderbird. The values of the mail.allowed_attachment_hostnames advanced configuration setting were inserted into a regular expression without escaping. Metacharacters within otherwise valid hostnames caused the resulting regex to match unintended hostnames, allowing remote attachments from hosts the user never approved. Mozilla fixed the issue in Thunderbird 155 and Thunderbird 153.2. The weakness is tracked under CWE-1333 (Inefficient Regular Expression Complexity), and it is exploitable over the network without user interaction or privileges.

Critical Impact
Attackers can cause Thunderbird to serve remote attachments from hostnames that were never explicitly allow-listed, undermining a user-configured trust boundary and exposing recipients to attacker-controlled content.

Affected Products

Mozilla Thunderbird versions prior to 155
Mozilla Thunderbird 153.x versions prior to 153.2
Deployments relying on mail.allowed_attachment_hostnames for remote attachment control

Discovery Timeline

2026-09-01 - CVE-2026-84642 published to NVD
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-84642

Vulnerability Analysis

Thunderbird uses the mail.allowed_attachment_hostnames preference to decide which remote hosts may serve attachments referenced in messages. Thunderbird converted each configured hostname directly into a regular expression pattern without escaping regex metacharacters such as ., *, +, ?, and |. As a result, the dot separators inside hostnames were treated as "any character" wildcards rather than literal periods. An entry like mail.example.com therefore matched hostnames such as mailxexample.com or attacker-controlled variants that reuse the surrounding character set. Attackers who register a lookalike hostname can serve remote attachments to Thunderbird users who believed only their configured hosts were trusted. The confidentiality impact is rated high because attachments and any embedded content can be fetched from unintended origins.

Root Cause

The root cause is missing input sanitization when converting user-controlled configuration strings into a regex pattern. Special regex characters present in valid DNS hostnames were not escaped, so the pattern's semantics diverged from the operator's intent. The correct approach is to escape metacharacters or perform literal string comparison against the parsed hostname component of the URL.

Attack Vector

Exploitation is network-based. An attacker crafts an HTML email containing a remote attachment reference to a hostname that satisfies the overly permissive regex derived from a victim's configuration. When Thunderbird evaluates the allow-list, the malformed pattern matches, and the client fetches the remote resource from the attacker's server. No user interaction beyond opening the message is required, and no prior authentication to the target system is needed. The vulnerability affects only environments that have set non-default values for mail.allowed_attachment_hostnames.

No verified public proof-of-concept code has been released. Technical details are available in the Bugzilla Entry #2060462 and the Mozilla Security Advisory MFSA-2026-86.

Detection Methods for CVE-2026-84642

Indicators of Compromise

Outbound HTTP or HTTPS connections from Thunderbird processes to hostnames that resemble but do not exactly match entries in mail.allowed_attachment_hostnames.
Message content referencing remote attachments hosted on domains registered close to the send time of the message.
Non-default values in mail.allowed_attachment_hostnames that contain regex-significant characters left unescaped.

Detection Strategies

Audit each managed Thunderbird profile's prefs.js for the mail.allowed_attachment_hostnames setting and flag any deployment running versions earlier than 155 or 153.2.
Correlate mail client network telemetry with the hostname allow-list to identify fetches to hosts that only match under the vulnerable regex interpretation.
Inspect email gateway logs for inbound messages containing remote attachment references to newly registered or typosquatted domains.

Monitoring Recommendations

Log DNS resolutions and TLS SNI values initiated by Thunderbird processes and compare them against the exact allow-list.
Alert on Thunderbird versions reported by asset inventory that fall below the fixed releases.
Track configuration drift in enterprise Thunderbird policy files distributed through management tooling.

How to Mitigate CVE-2026-84642

Immediate Actions Required

Upgrade Thunderbird to version 155 or, for the 153 branch, version 153.2 as documented in Mozilla Security Advisory MFSA-2026-88.
Inventory endpoints running Thunderbird and prioritize systems with customized mail.allowed_attachment_hostnames values.
Review current allow-list entries and remove any hostnames that are no longer required.

Patch Information

Mozilla addressed the flaw by escaping regex metacharacters before building the hostname match pattern. The fix ships in Thunderbird 155 and Thunderbird 153.2. Refer to Mozilla Security Advisory MFSA-2026-86 and Mozilla Security Advisory MFSA-2026-88 for release notes and download links.

Workarounds

Clear the mail.allowed_attachment_hostnames preference until Thunderbird is upgraded, forcing the client back to default remote attachment handling.
Restrict outbound network access from mail clients to a curated list of trusted content hosts using firewall or proxy egress rules.
Disable automatic loading of remote content in Thunderbird message display settings to reduce exposure to attacker-controlled fetches.

bash

# Configuration example: verify Thunderbird version and inspect the affected preference
thunderbird --version
grep -H 'mail.allowed_attachment_hostnames' \
  ~/.thunderbird/*/prefs.js