Stored XSS in Mailcow Dockerized 2026-03b Queue Manager (CVE-2026-7460)

Vulnerability Summary: Mailcow Dockerized 2026-03b Queue Manager Stored XSS Vulnerability Overview Vulnerability Name: Mailcow Dockerized 2026-03b - Stored XSS in Queue Manager Vulnerability Type: Stored Cross-Site Scripting (Stored XSS) Severity: High (CVSS v4.0 Base Score 7.4) CVE ID: CVE-2026-7460 Discoverer: Oscar Naveda (Fluid Attacks AI SAST Scanner) Root Cause: The administrator Queue Manager, after retrieving mail queue data from the Docker API, fails to HTML-escape fields such as , , and . These are inserted directly as HTML attributes or content into a DataTables table, leading to malicious script execution in the administrator's browser. Impact Scope Attacker Requirements: Low-privilege mail sender or anyone who can inject emails containing HTML markup into the Postfix queue. Victims: Users with administrative privileges (accessing ). Potential Harm: Reading Mailcow UI data visible to administrators. Performing administrative actions via authenticated APIs (subject to CSRF and permission checks). Stealing or abusing the administrator's browser session. Remediation Core Fix: Strict HTML Entity Encoding must be applied to queue data (specifically , , ) before rendering it to the frontend HTML. Specific Recommendations: 1. Escape fields containing user-controllable data either before the API returns data or when the frontend JavaScript renders DataTables. 2. Avoid using to insert unescaped data; use or safe DOM manipulation methods instead. 3. For fields like used as HTML attribute values, ensure their values do not contain quotes or special characters, or encode them using functions like . POC Code 1. Malicious Queue Row JSON Example (Triggers XSS in sender column) 2. Malicious queue_id Example (Triggers XSS in checkbox attribute) 3. Normal Queue Response Example (For Comparison) 4. Relevant Code Snippets (Vulnerability Point) API Returns Raw Data (Unescaped): Frontend Inserts Unescaped Data into DataTables: DataTables Renders as HTML:

Goal Reached Thanks to every supporter — we hit 100%!

Stored XSS in Mailcow Dockerized 2026-03b Queue Manager (CVE-2026-7460)

More from this source