Live › vulnerability › CVE-2026-120250
OpenAlgo versions from 1.0.0.29 up to 2.0.3.1 disable TLS hostname and certificate checks when sending mail over STARTTLS and SMTPS. A network attacker presenting a forged certificate can capture SMTP credentials and read later mail, including password-reset links.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-01 01:47 UTC. All times on this page are UTC.
Teams that run OpenAlgo with email features enabled, so it sends SMTP mail (password resets, alerts) over STARTTLS or SMTPS. The exposure is on the network path between the OpenAlgo server and its mail server, so an attacker must be positioned to intercept that traffic. Deployments that do not send mail through OpenAlgo, or that are on a version at or after 2.0.3.1, can skip it.
No product ranges from the sources yet.
1.0.0.29 up to but not including 2.0.3.1.utils/email_utils.py and utils/email_debug.py for disabled certificate or hostname verification on SMTP connections.2.0.3.1 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
OpenAlgo 1.0.0.29 before 2.0.3.1 contains an improper certificate validation vulnerability in utils/email_utils.py and utils/email_debug.py that disables TLS hostname and certificate checks for STARTTLS and SMTPS. Network-positioned attackers can present a forged certificate to intercept SMTP credentials and all later mail, including password-reset links.
This page as .md · .json · in your agent: get_signal("CVE-2026-120250")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.