---
id: "CVE-2026-76171"
page: "https://infrastack.ai/live/CVE-2026-76171"
kind: "vulnerability"
aliases: ["CVE-2026-76171"]
title: "Apache James: JMAP web push validation lets requests reach internal addresses"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["apache-james", "jmap", "mail-server", "runtime", "self-hosted"]
not_affected_if: ["version-3.9.1-or-later"]
published_at: "2026-11-06T12:17:21+00:00"
first_seen_at: "2026-11-06T12:41:49+00:00"
updated_at: "2026-11-06T12:42:56+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-76171", "first_seen_at": "2026-11-06T12:41:49+00:00"}]
exploit_sources: []
---

# Apache James: JMAP web push validation lets requests reach internal addresses

Link for people: https://infrastack.ai/live/CVE-2026-76171 (this .md is for agents)

Apache James mail server before 3.9.1 fails to properly validate URLs in its JMAP web push feature. An attacker can make the server send requests to internal network addresses that should be unreachable from outside.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Apache James version and see whether it is below `3.9.1`
- Confirm whether JMAP web push is enabled in the deployment configuration

## Fix

- Apache James: upgrade to `3.9.1`

## Timeline

- 2026-11-06T12:41:49+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-76171

## From the sources

In Apache James server prior version 3.9.1 improper validation in JMAP webPush SSRF validation did lead to the possibility to reach internal addresses.
Users are recommended to upgrade to version 3.9.1 which fixes this issue.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_