{"id":"CVE-2026-120250","kind":"vulnerability","aliases":["CVE-2026-120250"],"related":[],"title":"OpenAlgo: email code skips TLS certificate checks, exposing SMTP credentials","description":"OpenAlgo 1.0.0.29 before 2.0.3.1 contains an improper certificate validation vulnerability in utils/email_utils.py and utils/email_debug.py that disables TLS hostname and certificate checks for STARTTLS and SMTPS. Network-positioned attackers can present a forged certificate to intercept SMTP credentials and all later mail, including password-reset links.","summary":"OpenAlgo versions from 1.0.0.29 up to 2.0.3.1 disable TLS hostname and certificate checks when sending mail over STARTTLS and SMTPS. A network attacker presenting a forged certificate can capture SMTP credentials and read later mail, including password-reset links.","severity":"medium","cvss":6.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["openalgo","package","python","self-hosted","smtp"],"not_affected_if":["no-smtp-configured","version-2.0.3.1-or-later"],"how_to_check":"- Check the installed OpenAlgo version; affected builds are `1.0.0.29` up to but not including `2.0.3.1`.\n- Look at `utils/email_utils.py` and `utils/email_debug.py` for disabled certificate or hostname verification on SMTP connections.","fix":"- OpenAlgo: move to `2.0.3.1` or later.","status":"open","published_at":"2026-11-01T01:17:18+00:00","first_seen_at":"2026-11-01T01:47:22+00:00","triaged_at":"2026-11-01T01:47:43+00:00","updated_at":"2026-11-01T01:47:43+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-01T01:47:43Z","model":"claude-haiku-5-5","output":{"fix":"- OpenAlgo: move to `2.0.3.1` or later.","reach":"network","title":"OpenAlgo: email code skips TLS certificate checks, exposing SMTP credentials","impact":"medium","summary":"OpenAlgo versions from 1.0.0.29 up to 2.0.3.1 disable TLS hostname and certificate checks when sending mail over STARTTLS and SMTPS. A network attacker presenting a forged certificate can capture SMTP credentials and read later mail, including password-reset links.","audience":"businesses","category":"package","nicknames":[],"who_cares":["openalgo","python","self-hosted","smtp"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"SMTP credentials and password-reset mail readable by network attacker","analyst_note":"","how_to_check":"- Check the installed OpenAlgo version; affected builds are `1.0.0.29` up to but not including `2.0.3.1`.\n- Look at `utils/email_utils.py` and `utils/email_debug.py` for disabled certificate or hostname verification on SMTP connections.","plain_action":"","needs_analyst":false,"not_affected_if":["version-2.0.3.1-or-later","no-smtp-configured"],"who_is_affected":"Teams that run OpenAlgo with email features enabled, so it sends SMTP mail (password resets, alerts) over STARTTLS or SMTPS. The exposure is on the network path between the OpenAlgo server and its mail server, so an attacker must be positioned to intercept that traffic. Deployments that do not send mail through OpenAlgo, or that are on a version at or after 2.0.3.1, can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.00073,"input_tokens":4171,"output_tokens":626,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-120250':13A,16A '-2026':12A,15A '1.0.0.29':27B,65C '2.0.3.1':30B,67C 'attack':46B,92C 'captur':52B 'certif':6A,35B,50B,71C,83C,97C 'check':7A,36B,84C 'code':3A 'contain':68C 'credenti':10A,54B,101C 'cve':11A,14A 'disabl':31B,79C 'email':2A 'expos':8A 'forg':49B,96C 'host':22B 'hostnam':33B,81C 'improp':70C 'includ':59B,106C 'intercept':99C 'later':57B,104C 'link':63B,110C 'mail':39B,58B,105C 'network':45B,90C 'network-posit':89C 'openalgo':1A,17B,24B,64C 'packag':18B 'password':61B,108C 'password-reset':60B,107C 'posit':91C 'present':47B,94C 'python':19B 'read':56B 'reset':62B,109C 'self':21B 'self-host':20B 'send':38B 'skip':4A 'smtp':9A,23B,53B,100C 'smtps':43B,88C 'starttl':41B,86C 'tls':5A,32B,80C 'utils/email_debug.py':77C 'utils/email_utils.py':75C 'valid':72C 'version':25B 'vulner':73C","nicknames":[],"mitigations":[],"who_affected":"Teams that run OpenAlgo with email features enabled, so it sends SMTP mail (password resets, alerts) over STARTTLS or SMTPS. The exposure is on the network path between the OpenAlgo server and its mail server, so an attacker must be positioned to intercept that traffic. Deployments that do not send mail through OpenAlgo, or that are on a version at or after 2.0.3.1, can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-11-01T01:17:18+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120250","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120250","severity":null,"published_at":"2026-11-01T01:17:18+00:00","modified_at":"2026-11-01T01:17:18+00:00","first_seen_at":"2026-11-01T01:47:22+00:00","fetched_at":"2026-11-01T01:47:22+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}