Live › vulnerability › CVE-2026-114473
Go to dashboardhMailServer 6.2.1 through 6.3.6 with Sender Rewriting Scheme enabled treats any valid SRS address as a local delivery, skipping relay and SMTP authentication checks. An attacker holding a valid SRS address can make the server relay mail to the outside address that SRS address encodes, for 21 days.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Only hMailServer installations from 6.2.1 through 6.3.6 with SRS turned on are exposed, since SRS is off by default. Operators who forward mail between domains through hMailServer and use SRS should look at this first. Servers without SRS enabled can skip it.
No product ranges from the sources yet.
6.2.1 through 6.3.6.6.3.6; the sources do not name the fixed version.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Incorrect authorization in the Sender Rewriting Scheme (SRS) of Progressive Robot hMailServer 6.2.1 through 6.3.6 allows a remote attacker to relay mail through the server to outside addresses. With SRS enabled, the server rewrites the envelope sender of mail it forwards to a signed SRS address at the forwarding domain, and passes a bounce to that address back to the original sender; but it took every message to a valid SRS address, whatever its sender, as delivery to a local recipient, so the relay rules and the SMTP authentication they require were not applied, and the message was delivered to the outside address the SRS address encodes. Anyone holding a valid SRS address of the server, such as the recipient of a forwarded message, could have the server relay mail to the address it encodes for 21 days, and an account holder whose account forwards to an outside mailbox could obtain one for any address. SRS is off by default.
This page as .md · .json · in your agent: get_signal("CVE-2026-114473")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.