Live › vulnerability › CVE-2026-86009
Go to dashboardMailu is a self-hosted mail server shipped as Docker images. A domain manager can enable spoofing for another hosted domain, so they can send mail that passes DKIM and SPF checks for domains they do not administer.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running Mailu as a multi-domain mail server where some users are domain managers for only some hosted domains. A single-domain installation with one administrator is far less exposed. The sources do not state the exact affected version range.
No product ranges from the sources yet.
docker compose images or the tag of the mailu images.f05aeb8322e2f61096af6b089d61ba6f40587d96 is included in the deployed Mailu build.f05aeb8322e2f61096af6b089d61ba6f40587d96; the fixed release version is unknown from the sources.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Mailu is a mail server distributed as a set of Docker images. Prior to f05aeb8322e2f61096af6b089d61ba6f40587d96, domain managers can enable spoofing for hosted domains they do not control. A potentially malicious domain administrator enables spoofing for another hosted domain and can send emails that are authenticated with DKIM/SPF for domains they should not be able to. This vulnerability is addressed by f05aeb8322e2f61096af6b089d61ba6f40587d96.
This page as .md · .json · in your agent: get_signal("CVE-2026-86009")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.