---
id: "CVE-2026-121452"
kind: "vulnerability"
aliases: ["CVE-2026-121452"]
title: "bbs-go: SMTP certificate checks disabled, letting network attackers steal mail credentials"
severity: "high"
cvss: 8.3
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["bbs-go", "go", "runtime", "self-hosted", "smtp"]
not_affected_if: ["managed-hosting", "no-smtp-email"]
published_at: "2026-11-03T16:17:24+00:00"
first_seen_at: "2026-11-03T16:21:43+00:00"
updated_at: "2026-11-03T16:23:45+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121452", "first_seen_at": "2026-11-03T16:21:43+00:00"}]
---

# bbs-go: SMTP certificate checks disabled, letting network attackers steal mail credentials

bbs-go skips TLS certificate verification when it sends email through SMTP, so any party that can intercept the connection can impersonate the mail server. An attacker on the network path can capture SMTP login credentials and read or alter password-reset and verification emails.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the bbs-go version in use; the sources say versions through `4.4.6` are affected.
- Search the sendEmail() code path for `InsecureSkipVerify: true` in the Go source or build.

## Fix

- Upgrade bbs-go to a version newer than `4.4.6`; the sources do not name the exact fixed release.

## Timeline

- 2026-11-03T16:21:43+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-121452

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/bbs-go-through-4.4.6-improper-tls-certificate-validation-in-smtp-email-service
- [fix] Patch: github.com https://github.com/mlogclub/bbs-go/commit/1a06e35fa6314ee2d3ada70685a7afa740baf6f5

## From the sources

bbs-go through 4.4.6 contains an improper certificate validation vulnerability that allows network-positioned attackers to intercept SMTP traffic because sendEmail() sets InsecureSkipVerify to true. Attackers can present any certificate to capture SMTP PLAIN auth credentials and read or modify outgoing password-reset and verification emails.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_