Description

Forwarding information received from a host listed as a trusted proxy is not kept separate from Dovecot's own authentication fields, so a value sent by that host can be injected as an internal authentication field. Any host permitted to act as a trusted proxy can authenticate as any user without knowing that user's password. This affects deployments whose password database honours a field that permits authentication without a password. Deployments that do not configure trusted proxies are not affected. Restrict the list of trusted proxy networks to hosts that are fully under your control. Update to non-vulnerable version. No publicly available exploits are known.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-28T12:16:29.380Z",
  "pubdate": "2026-08-28T12:16:29.380Z",
  "executiveSummary": "This vulnerability involves an authentication bypass flaw in the Dovecot mail server, specifically concerning the handling of data received from trusted proxy hosts.\nThe issue is classified as an authentication field injection vulnerability. It allows an attacker operating from a compromised or malicious trusted proxy to authenticate as any arbitrary user without requiring valid credentials.\nThe core risk lies in the lack of isolation between proxy-supplied headers and internal authentication parameters within the Dovecot framework.\nImpact is contingent upon the configuration of the backend password database; specifically, deployments that utilize authentication backends which support password-less authentication fields are susceptible to full account takeover.\nThis vulnerability does not affect standard deployments where trusted proxies are disabled. The primary requirement for exploitation is the ability to communicate with the Dovecot instance from a host explicitly defined in the trusted proxy configuration.\nThere are currently no publicly available exploits, but the potential for unauthorized access remains critical for environments utilizing load balancers or proxying architectures.",
  "technicalDetails": "The root cause of this vulnerability is improper sanitization and data separation during the ingestion of proxy-provided headers. Dovecot fails to maintain a logical boundary between externally provided forwarding information and its own internal authentication session variables.\nWhen a host is configured as a trusted proxy, Dovecot implicitly trusts the data provided by that entity. During the authentication handshake, the system parses incoming fields and merges proxy-forwarded data directly into the internal authentication state machine.\nThe exploitation flow begins with an attacker controlling or injecting traffic into a host recognized by Dovecot as a trusted proxy. By crafting a specific authentication request, the attacker can manipulate the fields in a way that the Dovecot authentication process interprets the injected data as internal, authoritative authentication attributes.\nBecause the system fails to validate whether the forwarded data originated from a legitimate client or was injected by the proxy itself, the authentication backend receives a payload that instructs it to permit access without the standard verification of a password.\nThis is particularly dangerous in environments utilizing authentication mechanisms (such as specific LDAP, SQL, or PAM configurations) that honor fields signaling that a user has already been authenticated or should be bypassed. The payload effectively acts as a credential forgery, allowing the attacker to masquerade as any arbitrary user account within the system.\nThe vulnerability resides within the authentication framework of Dovecot. The attack surface is limited to network paths that allow traffic to reach the Dovecot authentication listener from a host identified within the 'trusted_proxy' network configuration.\nPost-exploitation, an attacker gains the full privileges associated with the targeted user account. In a mail server context, this typically entails unauthorized access to all stored emails, associated metadata, and potential further lateral movement within the mail infrastructure.\nThe exploit does not require knowledge of the target user's password, as the flaw subverts the authentication check entirely at the protocol processing layer."
}