{"id":"CVE-2026-114473","kind":"vulnerability","aliases":["CVE-2026-114473"],"related":[],"title":"hMailServer: forged SRS addresses let attackers relay mail outward","description":"Incorrect authorization in the Sender Rewriting Scheme (SRS) of Progressive Robot hMailServer 6.2.1 through 6.3.6 allows a remote attacker to relay mail through the server to outside addresses. With SRS enabled, the server rewrites the envelope sender of mail it forwards to a signed SRS address at the forwarding domain, and passes a bounce to that address back to the original sender; but it took every message to a valid SRS address, whatever its sender, as delivery to a local recipient, so the relay rules and the SMTP authentication they require were not applied, and the message was delivered to the outside address the SRS address encodes. Anyone holding a valid SRS address of the server, such as the recipient of a forwarded message, could have the server relay mail to the address it encodes for 21 days, and an account holder whose account forwards to an outside mailbox could obtain one for any address. SRS is off by default.","summary":"hMailServer 6.2.1 through 6.3.6 with Sender Rewriting Scheme enabled treats any valid SRS address as a local delivery, skipping relay and SMTP authentication checks. An attacker holding a valid SRS address can make the server relay mail to the outside address that SRS address encodes, for 21 days.","severity":"medium","cvss":5.0,"epss":0.00244,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["hmailserver","mail-server","package","self-hosted"],"not_affected_if":["default-config","srs-disabled"],"how_to_check":"- Check whether Sender Rewriting Scheme (SRS) is enabled in hMailServer settings; it is off by default.\n- Check the installed hMailServer version against `6.2.1` through `6.3.6`.","fix":"- Upgrade hMailServer to a version later than `6.3.6`; the sources do not name the fixed version.\n- Leave SRS disabled until patched if it is not required.","status":"open","published_at":"2026-10-21T16:17:34+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","triaged_at":"2026-10-25T04:29:27+00:00","updated_at":"2026-10-25T04:29:27+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T04:29:27Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade hMailServer to a version later than `6.3.6`; the sources do not name the fixed version.\n- Leave SRS disabled until patched if it is not required.","reach":"internet","title":"hMailServer: forged SRS addresses let attackers relay mail outward","impact":"medium","summary":"hMailServer 6.2.1 through 6.3.6 with Sender Rewriting Scheme enabled treats any valid SRS address as a local delivery, skipping relay and SMTP authentication checks. An attacker holding a valid SRS address can make the server relay mail to the outside address that SRS address encodes, for 21 days.","category":"package","nicknames":[],"who_cares":["hmailserver","self-hosted","mail-server"],"confidence":0.7,"needs_auth":"unknown","worst_case":"Attacker relays spam or phishing mail through the server to outside addresses","analyst_note":"Confirm the fixed hMailServer version and whether a patch or advisory exists; the NVD entry in the sources does not give it.","how_to_check":"- Check whether Sender Rewriting Scheme (SRS) is enabled in hMailServer settings; it is off by default.\n- Check the installed hMailServer version against `6.2.1` through `6.3.6`.","needs_analyst":true,"not_affected_if":["default-config","srs-disabled"],"who_is_affected":"Only hMailServer installations from 6.2.1 through 6.3.6 with SRS turned on are exposed, since SRS is off by default. Operators who forward mail between domains through hMailServer and use SRS should look at this first. Servers without SRS enabled can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000659,"input_tokens":3577,"output_tokens":603,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-114473':12A,15A '-2026':11A,14A '21':70B,208C '6.2.1':25B,84C '6.3.6':27B,86C 'account':212C,215C 'address':4A,37B,54B,64B,67B,99C,117C,128C,143C,174C,177C,184C,204C,226C 'allow':87C 'anyon':179C 'appli':165C 'attack':6A,49B,90C 'authent':46B,160C 'author':73C 'back':129C 'bounc':125C 'check':47B 'could':196C,221C 'cve':10A,13A 'day':71B,209C 'default':231C 'deliv':170C 'deliveri':41B,148C 'domain':121C 'enabl':32B,102C 'encod':68B,178C,206C 'envelop':107C 'everi':137C 'forg':2A 'forward':112C,120C,194C,216C 'hmailserv':1A,16B,24B,83C 'hold':50B,180C 'holder':213C 'host':23B 'incorrect':72C 'let':5A 'local':40B,151C 'mail':8A,18B,60B,93C,110C,201C 'mail-serv':17B 'mailbox':220C 'make':56B 'messag':138C,168C,195C 'obtain':222C 'one':223C 'origin':132C 'outsid':63B,98C,173C,219C 'outward':9A 'packag':20B 'pass':123C 'progress':81C 'recipi':152C,191C 'relay':7A,43B,59B,92C,155C,200C 'remot':89C 'requir':162C 'rewrit':30B,77C,105C 'robot':82C 'rule':156C 'scheme':31B,78C 'self':22B 'self-host':21B 'sender':29B,76C,108C,133C,146C 'server':19B,58B,96C,104C,187C,199C 'sign':115C 'skip':42B 'smtp':45B,159C 'srs':3A,36B,53B,66B,79C,101C,116C,142C,176C,183C,227C 'took':136C 'treat':33B 'valid':35B,52B,141C,182C 'whatev':144C 'whose':214C","nicknames":[],"mitigations":[],"who_affected":"Only hMailServer installations from 6.2.1 through 6.3.6 with SRS turned on are exposed, since SRS is off by default. Operators who forward mail between domains through hMailServer and use SRS should look at this first. Servers without SRS enabled can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T16:17:34+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N","cvss_by":"cve@gitlab.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114473","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114473","severity":null,"published_at":"2026-10-21T16:17:34+00:00","modified_at":"2026-10-22T16:18:19+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-114473","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114473","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}