CVE-2026-85751: Mailu Mail Server Auth Bypass Vulnerability

CVE-2026-85751 Overview

CVE-2026-85751 is an authentication bypass vulnerability in Mailu, a mail server distributed as a set of Docker images. Affected deployments trust a client-controlled X-Forwarded-By header for header-based proxy authentication when PROXY_AUTH_WHITELIST is configured but REAL_IP_HEADER is left unset. An unauthenticated remote attacker can spoof the trusted proxy identity and bypass authentication entirely. The flaw is tracked as [CWE-290: Authentication Bypass by Spoofing]. It is fixed in Mailu 2024.06.55 and Mailu helm-charts 2.7.3.

Critical Impact
Unauthenticated remote attackers can impersonate a trusted proxy and gain authenticated access to the Mailu web interface, exposing mailboxes and administrative functions.

Affected Products

Mailu versions from 2.0 up to but not including 2024.06.55
Mailu helm-charts prior to 2.7.3
Deployments configured with PROXY_AUTH_WHITELIST and no REAL_IP_HEADER

Discovery Timeline

2026-09-21 - CVE-2026-85751 published to NVD
2026-09-24 - Last updated in NVD database

Technical Details for CVE-2026-85751

Vulnerability Analysis

Mailu supports header-based proxy authentication through the PROXY_AUTH_WHITELIST setting. The nginx template at core/nginx/conf/proxy.conf uses the proxy_hide_header X-Forwarded-By directive to remove the header from upstream responses. This directive does not overwrite an incoming request value. When REAL_IP_HEADER is unset, the request path never rewrites X-Forwarded-By with a trusted value.

As a result, any attacker who reaches the Mailu HTTP endpoint can inject an X-Forwarded-By header carrying the IP address of an allowlisted proxy. Mailu treats the request as originating from a trusted proxy identity and grants authenticated access without credentials.

Root Cause

The root cause is misuse of the nginx proxy_hide_header directive. proxy_hide_header filters upstream response headers only. It does not sanitize incoming client request headers. The proxy authentication check relies on X-Forwarded-By, but the request pipeline forwards the attacker-supplied value untouched to the authentication logic.

Attack Vector

Exploitation requires only network reach to the Mailu web interface. An attacker sends an HTTP request containing a crafted X-Forwarded-By header set to the IP address of a proxy listed in PROXY_AUTH_WHITELIST. Combined with the corresponding proxy authentication headers, the request is accepted as authenticated. No credentials, user interaction, or prior access are required.

text

 proxy_set_header X-Forwarded-By $realip_remote_addr;
 {% else %}
 proxy_set_header X-Forwarded-For $remote_addr;
+proxy_set_header X-Forwarded-By $remote_addr;
 proxy_hide_header X-Forwarded-By;
 {% endif %}
 proxy_http_version 1.1;

Source: GitHub Mailu Commit Fix. The patch adds an explicit proxy_set_header X-Forwarded-By $remote_addr in the code path where REAL_IP_HEADER is unset, overwriting any attacker-supplied value with the true remote address before authentication logic runs.

Detection Methods for CVE-2026-85751

Indicators of Compromise

Inbound HTTP requests to Mailu containing an X-Forwarded-By header sourced directly from the internet rather than a legitimate reverse proxy.
Successful authenticated sessions or admin actions with no preceding login or credential submission in Mailu access logs.
Requests whose TCP peer address differs from the value declared in X-Forwarded-By or X-Forwarded-For.

Detection Strategies

Inspect nginx access logs for requests where the client IP is external but X-Forwarded-By matches an IP in PROXY_AUTH_WHITELIST.
Correlate authentication events in Mailu with upstream reverse proxy logs to detect sessions with no corresponding proxy transaction.
Deploy web application firewall rules to alert on client-supplied X-Forwarded-By headers on internet-facing Mailu endpoints.

Monitoring Recommendations

Enable verbose logging on the Mailu nginx container and forward logs to a centralized SIEM for header-level inspection.
Track the running Mailu image tag across hosts and alert on any deployment still on versions 2.0 through 2024.06.54.
Monitor administrative and mailbox access API calls for spikes in unauthenticated-turned-authenticated sessions.

How to Mitigate CVE-2026-85751

Immediate Actions Required

Upgrade Mailu Docker deployments to version 2024.06.55 or later.
Upgrade Mailu helm-charts to version 2.7.3 or later.
Audit PROXY_AUTH_WHITELIST values and remove any entries no longer required.
Review recent authentication events for signs of exploitation before patching.

Patch Information

The fix is delivered in Mailu Release v2024.06.55 and referenced in GitHub Security Advisory GHSA-rfhj-4wcq-74xg. The code changes are visible in Pull Request #4070 and Pull Request #4071, which modify core/nginx/conf/proxy.conf to explicitly overwrite X-Forwarded-By with $remote_addr.

Workarounds

Set REAL_IP_HEADER and REAL_IP_FROM in the Mailu environment so nginx replaces client-supplied trust headers with values derived from the actual TCP peer.
Terminate all inbound traffic at an upstream reverse proxy that strips X-Forwarded-By from client requests before forwarding.
Temporarily unset PROXY_AUTH_WHITELIST to disable header-based proxy authentication until the patched version is deployed.

bash

# Example: strip attacker-supplied X-Forwarded-By at an upstream nginx
location / {
    proxy_set_header X-Forwarded-By "";
    proxy_set_header X-Forwarded-For $remote_addr;
    proxy_pass http://mailu_front;
}