CVE-2026-114478— hMailServer 混淆代理漏洞
一分钟漏洞结论
影响对象
Progressive Robot Ltd hMailServer
利用判断
尚无明确在野利用证据，仍需结合暴露面评估
建议动作
优先检查厂商安全公告和参考链接中的修复版本；无法立即升级时，限制受影响服务暴露并加强监测。
Progressive Robot hMailServer 6.0.0 至 6.3.6 版本在邮件转发过程中未能充分保留原始发件人信息，使得远程未认证攻击者能够伪造邮件，将其"From"字段设置为该服务器所托管域内的地址，并成功通过接收方对该域的 DMARC 策略验证。 当服务器转发来自外部的邮件副本时（例如：账户转发、邮件规则转发、Sieve 重定向、邮件列表副本，或别名/列表扩展至外部地址），它可能为该副本赋予一个 SMTP 身份，该身份属于"From"字段所指向域的所属组织，而无论该邮件的实际来源如何。具体行
获取后续新漏洞提醒
登录后订阅
一、 漏洞 CVE-2026-114478 基础信息
漏洞信息
对漏洞内容有疑问？看看神龙的深度分析是否有帮助！
查看神龙十问 ↗
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
Unintended Proxy or Intermediary ('Confused Deputy') in hMailServer
来源: CVE Program / CVE List V5
Vulnerability Description
Insufficient preservation of the original sender in the forwarding of Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a remote unauthenticated attacker to have mail they write, naming in its From an address at a domain the server hosts, delivered to other receivers as passing that domain's DMARC policy. When the server sent on a copy of mail that came from outside - an account's forward, a mail rule's forward, a Sieve redirect, a list's copy, or an alias or list expanding to an outside address - it could give the copy an SMTP identity in the organisation of the domain the copy's From names, whatever the message's origin: with the Sender Rewriting Scheme or the rewrite of the envelope sender on forwarding enabled (both off by default), an address at the forwarding domain; for a list, its bounce address; for a message with an empty envelope sender, none, under the server's own host name; and an envelope sender the message came with at a subdomain of a hosted domain was kept. Where that identity's SPF record authorises the server, other receivers' SPF check of the copy passed for a domain aligned with the From, and DMARC passed with it, although the message had not passed DMARC when the server received it. Exploitation needs a forward, redirect, alias or list that carries the hosted domain's mail to an outside address, and one of: SRS or the envelope rewrite enabled; a list whose bounce address is in the domain's organisation; an envelope sender at a subdomain whose SPF record authorises the server; or, for an empty envelope sender, an SPF record that authorises the server under its host name. The DKIM route to the same result is CVE-2026-107567.
来源: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
来源: CVE Program / CVE List V5
Vulnerability Type
未有动机的代理或中间人(混淆代理)
来源: CVE Program / CVE List V5
受影响产品
| 厂商 | 产品 | 影响版本 | CPE | 订阅 |
|---|---|---|---|---|
| Progressive Robot Ltd | hMailServer | 6.0.0 ~ 6.3.6 | - |
|
二、漏洞 CVE-2026-114478 的公开POC
| # | POC 描述 | 源链接 | 神龙链接 |
|---|
AI 生成 POC
高级
未找到公开 POC。
登录以生成 AI POC三、漏洞 CVE-2026-114478 的情报信息
请登录查看更多情报信息。
CVE-2026-114478 厂商页面 (1)
CVE-2026-114478 其他参考 (1)
同批安全公告 · Progressive Robot Ltd · 2026-10-21 · 共 12 条
| CVE-2026-114489 | 8.1 HIGH | hMailServer 授权缺失漏洞 |
| CVE-2026-114490 | 7.8 HIGH | hMailServer 身份验证错误漏洞 |
| CVE-2026-114476 | 7.5 HIGH | hMailServer 身份验证错误漏洞 |
| CVE-2026-114475 | 6.5 MEDIUM | hMailServer 授权缺失漏洞 |
| CVE-2026-114474 | 5.9 MEDIUM | hMailServer 使用不可信来源漏洞 |
| CVE-2026-114479 | 5.8 MEDIUM | hMailServer 非安全失败（开放）漏洞 |
| CVE-2026-114470 | 5.3 MEDIUM | hMailServer 跨站请求伪造漏洞 |
| CVE-2026-114473 | 5.0 MEDIUM | hMailServer 身份验证绕过漏洞 |
| CVE-2026-114471 | 4.7 MEDIUM | hMailServer 敏感信息写入日志文件漏洞 |
| CVE-2026-114477 | 4.3 MEDIUM | hMailServer 未授权访问漏洞 |
| CVE-2026-114472 | 3.7 LOW | hMailServer 资源池不足漏洞 |
IV. Related Vulnerabilities
V. Comments for CVE-2026-114478
暂无评论