{"id":"CVE-2026-107567","kind":"vulnerability","aliases":["CVE-2026-107567"],"related":[],"title":"hMailServer: DKIM signing lets outside senders forge mail as hosted domains","description":"Use of a less trusted source in the DKIM signing of Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a remote unauthenticated attacker to have mail they write signed with the DKIM key of a domain the server hosts, so that it passes DKIM and DMARC for that domain at other receivers. With DKIM signing enabled for a hosted domain, the server signed every message on its first delivery pass as the domain named in its From header, before local delivery, whatever the message's origin and without checking that its sender had authenticated. A sender anywhere could therefore send the server, as ordinary inbound mail, a message whose From is any address at such a domain, and the server signed it with that domain's key. Every copy the server then sent on to an address outside carried a valid signature aligned with the forged From, whatever the domain's DMARC policy: an account's forward, a mail rule's forward or copy, a Sieve redirect, an alias or distribution list with an outside member, the mirror copy, a managed-list or journal copy, or a message released from quarantine. A signed copy can also be re-sent to other recipients while the domain's key is unchanged. Exploitation needs DKIM signing to be enabled for the hosted domain (it is off until configured) and, for the forgery to leave the server, a forward, alias, list or rule that carries the domain's mail to an outside address. The signer likewise signed a message submitted over authenticated SMTP as whatever hosted domain its From header named, a header authenticated SMTP does not hold to the submitting account, so that an account of one hosted domain could have mail written in the name of another hosted domain signed with that domain's key; this mattered where the server holds signed-in senders to their own envelope addresses (SmtpAuthenticatedSenderCheck, off by default), as the signature was then the remaining way for such mail to pass the other domain's DMARC policy.","summary":"hMailServer 6.0.0 through 6.3.6 signs any inbound message with the DKIM key of whatever hosted domain its From header names, without checking the sender. An attacker can get forged mail that passes DKIM and DMARC at other receivers once it is forwarded or relayed outside the server.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dkim","dmarc","email","hmailserver","package","self-hosted"],"not_affected_if":["default-config","dkim-signing-disabled"],"how_to_check":"- Check the installed hMailServer version in the Administrator console or the installation's version information; affected range is `6.0.0` through `6.3.6`.\n- In the hMailServer Administrator, open each hosted domain's DKIM settings and confirm whether DKIM signing is enabled.\n- Review forwards, aliases, distribution lists, mail rules and Sieve redirects that send hosted-domain mail to outside addresses.","fix":"- Upgrade hMailServer past `6.3.6`; the sources do not name the fixed version.\n- Disable DKIM signing for hosted domains until the upgrade is applied, if signing is not needed.\n- Enable SmtpAuthenticatedSenderCheck, which is off by default.","status":"open","published_at":"2026-10-19T16:17:01+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","triaged_at":"2026-10-25T03:23:01+00:00","updated_at":"2026-10-25T03:23:01+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-25T03:23:01Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade hMailServer past `6.3.6`; the sources do not name the fixed version.\n- Disable DKIM signing for hosted domains until the upgrade is applied, if signing is not needed.\n- Enable SmtpAuthenticatedSenderCheck, which is off by default.","reach":"internet","title":"hMailServer: DKIM signing lets outside senders forge mail as hosted domains","impact":"medium","summary":"hMailServer 6.0.0 through 6.3.6 signs any inbound message with the DKIM key of whatever hosted domain its From header names, without checking the sender. An attacker can get forged mail that passes DKIM and DMARC at other receivers once it is forwarded or relayed outside the server.","category":"package","nicknames":[],"who_cares":["hmailserver","self-hosted","email","dkim","dmarc"],"confidence":0.8,"needs_auth":"no","worst_case":"Attackers send forged mail that passes DKIM and DMARC for hosted domains","analyst_note":"Find the fixed hMailServer version and the vendor advisory; the NVD entry and sources here do not name it.","how_to_check":"- Check the installed hMailServer version in the Administrator console or the installation's version information; affected range is `6.0.0` through `6.3.6`.\n- In the hMailServer Administrator, open each hosted domain's DKIM settings and confirm whether DKIM signing is enabled.\n- Review forwards, aliases, distribution lists, mail rules and Sieve redirects that send hosted-domain mail to outside addresses.","needs_analyst":true,"not_affected_if":["default-config","dkim-signing-disabled"],"who_is_affected":"Servers running hMailServer 6.0.0 through 6.3.6 with DKIM signing enabled for at least one hosted domain are exposed. Exposure also requires a forward, alias, list or rule that sends that domain's mail to an outside address, which is what lets forged mail leave the server. Servers without DKIM signing enabled, which is the default, are not affected.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000755,"input_tokens":3843,"output_tokens":741,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-107567':14A,17A '-2026':13A,16A '6.0.0':27B,87C '6.3.6':29B,89C 'account':226C,351C,355C 'address':184C,208C,322C,391C 'alia':240C,309C 'align':214C 'allow':90C 'also':268C 'anoth':368C 'anywher':168C 'attack':51B,94C 'authent':165C,331C,343C 'carri':210C,314C 'check':47B,160C 'configur':298C 'copi':200C,235C,250C,257C,266C 'could':169C,360C 'cve':12A,15A 'default':395C 'deliveri':140C,152C 'distribut':242C 'dkim':2A,18B,36B,58B,81C,103C,115C,125C,285C 'dmarc':19B,60B,117C,223C,413C 'domain':11A,41B,107C,120C,131C,144C,188C,196C,221C,278C,293C,316C,336C,359C,370C,374C,411C 'email':20B 'enabl':127C,289C 'envelop':390C 'everi':135C,199C 'exploit':283C 'first':139C 'forg':7A,54B,217C 'forgeri':302C 'forward':67B,228C,233C,308C 'get':53B 'header':44B,149C,339C,342C 'hmailserv':1A,21B,26B,86C 'hold':347C,382C 'host':10A,25B,40B,110C,130C,292C,335C,358C,369C 'inbound':32B,176C 'journal':256C 'key':37B,104C,198C,280C,376C 'leav':304C 'less':76C 'let':4A 'likewis':325C 'list':243C,254C,310C 'local':151C 'mail':8A,55B,97C,177C,230C,318C,362C,406C 'manag':253C 'managed-list':252C 'matter':378C 'member':247C 'messag':33B,136C,155C,179C,260C,328C 'mirror':249C 'name':45B,145C,340C,366C 'need':284C 'one':357C 'ordinari':175C 'origin':157C 'outsid':5A,70B,209C,246C,321C 'packag':22B 'pass':57B,114C,141C,408C 'polici':224C,414C 'progress':84C 'quarantin':263C 're':271C 're-sent':270C 'receiv':63B,123C 'recipi':275C 'redirect':238C 'relay':69B 'releas':261C 'remain':402C 'remot':92C 'robot':85C 'rule':231C,312C 'self':24B 'self-host':23B 'send':171C 'sender':6A,49B,163C,167C,386C 'sent':204C,272C 'server':72B,109C,133C,173C,191C,202C,306C,381C 'siev':237C 'sign':3A,30B,82C,100C,126C,134C,192C,265C,286C,326C,371C,384C 'signatur':213C,398C 'signed-in':383C 'signer':324C 'smtp':332C,344C 'smtpauthenticatedsendercheck':392C 'sourc':78C 'submit':329C,350C 'therefor':170C 'trust':77C 'unauthent':93C 'unchang':282C 'use':73C 'valid':212C 'way':403C 'whatev':39B,153C,219C,334C 'whose':180C 'without':46B,159C 'write':99C 'written':363C","nicknames":[],"mitigations":[],"who_affected":"Servers running hMailServer 6.0.0 through 6.3.6 with DKIM signing enabled for at least one hosted domain are exposed. Exposure also requires a forward, alias, list or rule that sends that domain's mail to an outside address, which is what lets forged mail leave the server. Servers without DKIM signing enabled, which is the default, are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T16:17:01+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","cvss_by":"cve@gitlab.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-107567","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107567","severity":null,"published_at":"2026-10-19T16:17:01+00:00","modified_at":"2026-10-20T20:17:13+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}