{"id":"CVE-2026-126611","kind":"vulnerability","aliases":["CVE-2026-126611"],"related":[],"title":"hMailServer: local impostor can capture database password under verify-full","description":"Progressive Robot hMailServer 6.3.4 through 6.3.7, with a MySQL or MariaDB database, TlsMode=verify-full and no TlsCaFile, does not verify the database server's certificate's issuer or name when the connection is one that MariaDB Connector/C treats as local - Server= set to 127.0.0.1, ::1 or localhost (on Linux a Unix socket), to . on Windows (a named pipe), or to a comma-separated list of servers that holds such an element - which allows a local attacker who can stand in for the database server, for example by listening on its port while it is stopped or restarting, to receive the database sign-in, the password included, and to read and modify the traffic between hMailServer and its database. hMailServer applied verify-full by turning the client's certificate verification on without a CA file, but MariaDB Connector/C 3.4.1 and later, on a connection they treat as local and with no CA file, accept any certificate within its validity period that is self-signed or sent with its own root, for any name (Connector/C 3.4.2 to 3.4.10 also one whose issuer they cannot find), so the client accepted the certificate an impostor made, asked no proof of the password and allowed a switch to an authentication method that sends the password unhashed, while hmailserver --check-database said the certificate had been checked against the system's trust store and the application log that it had been checked. The Windows builds bundle Connector/C 3.4.9 (6.3.4 to 6.3.6) and 3.4.11 (6.3.7); on Linux the distribution's client is used, and Connector/C 3.3 and 3.4.0 and Oracle's MySQL client are not affected. The configuration is not the default: TlsMode defaults to prefer, which checks no certificate.","summary":"hMailServer 6.3.4 through 6.3.7 with MySQL or MariaDB and TlsMode=verify-full but no TlsCaFile fails to verify the database server's certificate on local connections. A local attacker who impersonates the database can capture the sign-in password and read or modify traffic between hMailServer and its database.","severity":"high","cvss":7.0,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"hMailServer","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["hmailserver","mariadb","mysql","runtime","self-hosted","windows"],"not_affected_if":["default-config","no-mysql-or-mariadb","remote-database-only","tls-prefer"],"how_to_check":"- Check the hMailServer version: it is affected from `6.3.4` through `6.3.7`.\n- Check whether TlsMode is set to `verify-full` and no TlsCaFile is configured.\n- Check whether the Server setting points to 127.0.0.1, ::1, localhost, a Unix socket, a named pipe (`.`), or a list containing such an entry.\n- On Windows builds, the bundled MariaDB Connector/C is `3.4.9` (6.3.4 to 6.3.6) or `3.4.11` (6.3.7).","fix":null,"status":"open","published_at":"2026-11-11T09:17:12+00:00","first_seen_at":"2026-11-11T09:26:48+00:00","triaged_at":"2026-11-11T09:28:41+00:00","updated_at":"2026-11-11T09:28:41+00:00","category":"runtime","confidence":0.8,"triage":{"at":"2026-11-11T09:28:41Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"hMailServer: local impostor can capture database password under verify-full","impact":"high","summary":"hMailServer 6.3.4 through 6.3.7 with MySQL or MariaDB and TlsMode=verify-full but no TlsCaFile fails to verify the database server's certificate on local connections. A local attacker who impersonates the database can capture the sign-in password and read or modify traffic between hMailServer and its database.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["hmailserver","mysql","mariadb","windows","self-hosted"],"confidence":0.8,"fix_status":"unknown","needs_auth":"no","worst_case":"local attacker steals database password and alters database traffic","analyst_note":"","how_to_check":"- Check the hMailServer version: it is affected from `6.3.4` through `6.3.7`.\n- Check whether TlsMode is set to `verify-full` and no TlsCaFile is configured.\n- Check whether the Server setting points to 127.0.0.1, ::1, localhost, a Unix socket, a named pipe (`.`), or a list containing such an entry.\n- On Windows builds, the bundled MariaDB Connector/C is `3.4.9` (6.3.4 to 6.3.6) or `3.4.11` (6.3.7).","plain_action":"","product_name":"hMailServer","needs_analyst":false,"not_affected_if":["default-config","tls-prefer","no-mysql-or-mariadb","remote-database-only"],"who_is_affected":"Exposure requires a MySQL or MariaDB database, TlsMode set to verify-full, no TlsCaFile, and a Server setting that the MariaDB Connector/C treats as local. The attacker must already be on the same machine, able to listen on the database port while the database is stopped or restarting. TlsMode defaults to prefer, which checks no certificate, so default installations are not affected.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.001422,"input_tokens":5047,"output_tokens":1834,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-126611':14A,17A '-2026':13A,16A '1':124C '127.0.0.1':123C '3.3':343C '3.4.0':345C '3.4.1':220C '3.4.10':259C '3.4.11':331C '3.4.2':257C '3.4.9':326C '6.3.4':28B,81C,327C '6.3.6':329C '6.3.7':30B,83C,332C 'accept':235C,270C 'affect':353C 'allow':153C,283C 'also':260C 'appli':201C 'applic':314C 'ask':276C 'attack':56B,156C 'authent':288C 'build':323C 'bundl':324C 'ca':215C,233C 'cannot':265C 'captur':5A,62B 'certif':50B,104C,210C,237C,272C,302C,367C 'check':298C,305C,320C,365C 'check-databas':297C 'client':208C,269C,338C,350C 'comma':142C 'comma-separ':141C 'configur':355C 'connect':53B,111C,225C 'connector/c':116C,219C,256C,325C,342C 'cve':12A,15A 'databas':6A,47B,60B,77B,89C,101C,163C,181C,199C,299C 'default':359C,361C 'distribut':336C 'element':151C 'exampl':166C 'fail':43B 'file':216C,234C 'find':266C 'full':11A,39B,93C,204C 'hmailserv':1A,19B,27B,74B,80C,196C,200C,296C 'hmailserver':18A 'hold':148C 'host':25B 'imperson':58B 'impostor':3A,274C 'includ':187C 'issuer':106C,263C 'later':222C 'linux':128C,334C 'list':144C 'listen':168C 'local':2A,52B,55B,119C,155C,229C 'localhost':126C 'log':315C 'made':275C 'mariadb':20B,34B,88C,115C,218C 'method':289C 'modifi':71B,192C 'mysql':21B,32B,86C,349C 'name':108C,136C,255C 'one':113C,261C 'oracl':347C 'password':7A,67B,186C,281C,293C 'period':241C 'pipe':137C 'port':171C 'prefer':363C 'progress':78C 'proof':278C 'read':69B,190C 'receiv':179C 'restart':177C 'robot':79C 'root':252C 'runtim':22B 'said':300C 'self':24B,245C 'self-host':23B 'self-sign':244C 'send':291C 'sent':248C 'separ':143C 'server':48B,102C,120C,146C,164C 'set':121C 'sign':65B,183C,246C 'sign-in':64B,182C 'socket':131C 'stand':159C 'stop':175C 'store':311C 'switch':285C 'system':308C 'tlscafil':42B,96C 'tlsmode':36B,90C,360C 'traffic':72B,194C 'treat':117C,227C 'trust':310C 'turn':206C 'unhash':294C 'unix':130C 'use':340C 'valid':240C 'verif':211C 'verifi':10A,38B,45B,92C,99C,203C 'verify-ful':9A,37B,91C,202C 'whose':262C 'window':26B,134C,322C 'within':238C 'without':213C","nicknames":[],"mitigations":[],"who_affected":"Exposure requires a MySQL or MariaDB database, TlsMode set to verify-full, no TlsCaFile, and a Server setting that the MariaDB Connector/C treats as local. The attacker must already be on the same machine, able to listen on the database port while the database is stopped or restarting. TlsMode defaults to prefer, which checks no certificate, so default installations are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["hmailserver"],"ptokens":["hmailserver"],"labels":["high","hmailserver","mariadb","mysql","runtime","selfhosted","vendor","windows"],"campaign_type":null,"search_a":"'-126611':14A,17A '-2026':13A,16A 'captur':5A 'cve':12A,15A 'databas':6A 'full':11A 'hmailserv':1A 'hmailserver':18A 'impostor':3A 'local':2A 'password':7A 'verifi':10A 'verify-ful':9A","search_b":"'6.3.4':28B '6.3.7':30B 'attack':56B 'captur':62B 'certif':50B 'connect':53B 'databas':47B,60B,77B 'fail':43B 'full':39B 'hmailserv':19B,27B,74B 'host':25B 'imperson':58B 'local':52B,55B 'mariadb':20B,34B 'modifi':71B 'mysql':21B,32B 'password':67B 'read':69B 'runtim':22B 'self':24B 'self-host':23B 'server':48B 'sign':65B 'sign-in':64B 'tlscafil':42B 'tlsmode':36B 'traffic':72B 'verifi':38B,45B 'verify-ful':37B 'window':26B","search_c":"'1':124C '127.0.0.1':123C '3.3':343C '3.4.0':345C '3.4.1':220C '3.4.10':259C '3.4.11':331C '3.4.2':257C '3.4.9':326C '6.3.4':81C,327C '6.3.6':329C '6.3.7':83C,332C 'accept':235C,270C 'affect':353C 'allow':153C,283C 'also':260C 'appli':201C 'applic':314C 'ask':276C 'attack':156C 'authent':288C 'build':323C 'bundl':324C 'ca':215C,233C 'cannot':265C 'certif':104C,210C,237C,272C,302C,367C 'check':298C,305C,320C,365C 'check-databas':297C 'client':208C,269C,338C,350C 'comma':142C 'comma-separ':141C 'configur':355C 'connect':111C,225C 'connector/c':116C,219C,256C,325C,342C 'databas':89C,101C,163C,181C,199C,299C 'default':359C,361C 'distribut':336C 'element':151C 'exampl':166C 'file':216C,234C 'find':266C 'full':93C,204C 'hmailserv':80C,196C,200C,296C 'hold':148C 'impostor':274C 'includ':187C 'issuer':106C,263C 'later':222C 'linux':128C,334C 'list':144C 'listen':168C 'local':119C,155C,229C 'localhost':126C 'log':315C 'made':275C 'mariadb':88C,115C,218C 'method':289C 'modifi':192C 'mysql':86C,349C 'name':108C,136C,255C 'one':113C,261C 'oracl':347C 'password':186C,281C,293C 'period':241C 'pipe':137C 'port':171C 'prefer':363C 'progress':78C 'proof':278C 'read':190C 'receiv':179C 'restart':177C 'robot':79C 'root':252C 'said':300C 'self':245C 'self-sign':244C 'send':291C 'sent':248C 'separ':143C 'server':102C,120C,146C,164C 'set':121C 'sign':183C,246C 'sign-in':182C 'socket':131C 'stand':159C 'stop':175C 'store':311C 'switch':285C 'system':308C 'tlscafil':96C 'tlsmode':90C,360C 'traffic':194C 'treat':117C,227C 'trust':310C 'turn':206C 'unhash':294C 'unix':130C 'use':340C 'valid':240C 'verif':211C 'verifi':92C,99C,203C 'verify-ful':91C,202C 'whose':262C 'window':134C,322C 'within':238C 'without':213C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T09:17:12+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"cve@gitlab.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126611","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126611","severity":null,"published_at":"2026-11-11T09:17:12+00:00","modified_at":"2026-11-11T09:17:12+00:00","first_seen_at":"2026-11-11T09:26:48+00:00","fetched_at":"2026-11-11T09:26:48+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}