{"id":"CVE-2026-126133","kind":"vulnerability","aliases":["CVE-2026-126133"],"related":[],"title":"Thunderbird: calendar passwords sent to a malicious HTTP proxy","description":"When a CalDAV or ICS calendar was accessed through an HTTP proxy that requested authentication, Thunderbird could answer the proxy with the calendar server's username and password. This affected both setting up a new calendar and syncing existing calendars, where a saved password could be sent without any user interaction. A malicious or compromised proxy could use this to obtain the calendar credentials, even for calendars served over HTTPS. This vulnerability was fixed in Thunderbird 160.","summary":"When Thunderbird reaches a CalDAV or ICS calendar through an HTTP proxy that asks for authentication, it can reply to the proxy with the calendar server's saved username and password. A malicious or compromised proxy can collect those calendar credentials, including for HTTPS calendars.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["caldav","ics","package","thunderbird"],"not_affected_if":["no-authenticating-proxy","no-calendar-sync"],"how_to_check":"- Check the installed Thunderbird version under Help > About Thunderbird; versions below `160` are affected.\n- Check whether calendars (CalDAV or ICS) are configured and whether the connection goes through an HTTP proxy that requires authentication.","fix":"- Thunderbird `160`","status":"open","published_at":"2026-11-10T19:21:13+00:00","first_seen_at":"2026-11-10T19:25:15+00:00","triaged_at":"2026-11-10T20:04:50+00:00","updated_at":"2026-11-10T20:04:50+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-10T20:04:50Z","model":"claude-haiku-5-5","output":{"fix":"- Thunderbird `160`","reach":"network","title":"Thunderbird: calendar passwords sent to a malicious HTTP proxy","impact":"medium","summary":"When Thunderbird reaches a CalDAV or ICS calendar through an HTTP proxy that asks for authentication, it can reply to the proxy with the calendar server's saved username and password. A malicious or compromised proxy can collect those calendar credentials, including for HTTPS calendars.","audience":"everyone","category":"package","nicknames":[],"who_cares":["thunderbird","caldav","ics"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"calendar server credentials leak to a malicious proxy operator","analyst_note":"","how_to_check":"- Check the installed Thunderbird version under Help > About Thunderbird; versions below `160` are affected.\n- Check whether calendars (CalDAV or ICS) are configured and whether the connection goes through an HTTP proxy that requires authentication.","plain_action":"Update Thunderbird to version 160 or later through Help > About Thunderbird.","product_name":"","needs_analyst":false,"not_affected_if":["no-calendar-sync","no-authenticating-proxy"],"who_is_affected":"Thunderbird users who sync CalDAV or ICS calendars through an HTTP proxy that requires authentication. A malicious or compromised proxy is the attacker in this scenario. Users without calendars or without an authenticating proxy are not exposed.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000746,"input_tokens":4605,"output_tokens":572,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-126133':12A,15A '-2026':11A,14A '160':141C 'access':72C 'affect':94C 'answer':82C 'ask':33B 'authent':35B,79C 'caldav':16B,24B,67C 'calendar':2A,27B,44B,59B,64B,70C,87C,100C,104C,127C,131C 'collect':57B 'compromis':54B,119C 'could':81C,109C,121C 'credenti':60B,128C 'cve':10A,13A 'even':129C 'exist':103C 'fix':138C 'http':8A,30B,75C 'https':63B,134C 'ic':17B,26B,69C 'includ':61B 'interact':115C 'malici':7A,52B,117C 'new':99C 'obtain':125C 'packag':18B 'password':3A,50B,92C,108C 'proxi':9A,31B,41B,55B,76C,84C,120C 'reach':22B 'repli':38B 'request':78C 'save':47B,107C 'sent':4A,111C 'serv':132C 'server':45B,88C 'set':96C 'sync':102C 'thunderbird':1A,19B,21B,80C,140C 'use':122C 'user':114C 'usernam':48B,90C 'vulner':136C 'without':112C","nicknames":[],"mitigations":[],"who_affected":"Thunderbird users who sync CalDAV or ICS calendars through an HTTP proxy that requires authentication. A malicious or compromised proxy is the attacker in this scenario. Users without calendars or without an authenticating proxy are not exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"everyone","plain_action":"Update Thunderbird to version 160 or later through Help > About Thunderbird.","pkeys":[],"ptokens":[],"labels":["caldav","ics","package","thunderbird","unknown"],"campaign_type":null,"search_a":"'-126133':12A,15A '-2026':11A,14A 'calendar':2A 'cve':10A,13A 'http':8A 'malici':7A 'password':3A 'proxi':9A 'sent':4A 'thunderbird':1A","search_b":"'ask':33B 'authent':35B 'caldav':16B,24B 'calendar':27B,44B,59B,64B 'collect':57B 'compromis':54B 'credenti':60B 'http':30B 'https':63B 'ic':17B,26B 'includ':61B 'malici':52B 'packag':18B 'password':50B 'proxi':31B,41B,55B 'reach':22B 'repli':38B 'save':47B 'server':45B 'thunderbird':19B,21B 'usernam':48B","search_c":"'160':141C 'access':72C 'affect':94C 'answer':82C 'authent':79C 'caldav':67C 'calendar':70C,87C,100C,104C,127C,131C 'compromis':119C 'could':81C,109C,121C 'credenti':128C 'even':129C 'exist':103C 'fix':138C 'http':75C 'https':134C 'ic':69C 'interact':115C 'malici':117C 'new':99C 'obtain':125C 'password':92C,108C 'proxi':76C,84C,120C 'request':78C 'save':107C 'sent':111C 'serv':132C 'server':88C 'set':96C 'sync':102C 'thunderbird':80C,140C 'use':122C 'user':114C 'usernam':90C 'vulner':136C 'without':112C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:21:13+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126133","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126133","severity":null,"published_at":"2026-11-10T19:21:13+00:00","modified_at":"2026-11-10T19:21:13+00:00","first_seen_at":"2026-11-10T19:25:15+00:00","fetched_at":"2026-11-10T19:25:15+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}