{"id":"CVE-2026-86009","kind":"vulnerability","aliases":["CVE-2026-86009"],"related":[],"title":"Mailu: domain managers can spoof mail for domains they do not control","description":"Mailu is a mail server distributed as a set of Docker images. Prior to f05aeb8322e2f61096af6b089d61ba6f40587d96, domain managers can enable spoofing for hosted domains they do not control. A potentially malicious domain administrator enables spoofing for another hosted domain and can send emails that are authenticated with DKIM/SPF for domains they should not be able to. This vulnerability is addressed by f05aeb8322e2f61096af6b089d61ba6f40587d96.","summary":"Mailu is a self-hosted mail server shipped as Docker images. A domain manager can enable spoofing for another hosted domain, so they can send mail that passes DKIM and SPF checks for domains they do not administer.","severity":"high","cvss":8.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["docker","infrastructure","mail-server","mailu","self-hosted"],"not_affected_if":["no-domain-managers","single-domain-deployment"],"how_to_check":"- Check the Mailu image version in your compose file or deployment, e.g. `docker compose images` or the tag of the mailu images.\n- Confirm whether the commit `f05aeb8322e2f61096af6b089d61ba6f40587d96` is included in the deployed Mailu build.","fix":"- Update Mailu to a build that includes commit `f05aeb8322e2f61096af6b089d61ba6f40587d96`; the fixed release version is unknown from the sources.\n- Review existing domain manager accounts and any spoofing settings enabled on hosted domains.","status":"open","published_at":"2026-10-16T17:17:51+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","triaged_at":"2026-10-25T03:04:30+00:00","updated_at":"2026-10-25T03:04:30+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-25T03:04:30Z","model":"claude-haiku-5-5","output":{"fix":"- Update Mailu to a build that includes commit `f05aeb8322e2f61096af6b089d61ba6f40587d96`; the fixed release version is unknown from the sources.\n- Review existing domain manager accounts and any spoofing settings enabled on hosted domains.","reach":"network","title":"Mailu: domain managers can spoof mail for domains they do not control","impact":"medium","summary":"Mailu is a self-hosted mail server shipped as Docker images. A domain manager can enable spoofing for another hosted domain, so they can send mail that passes DKIM and SPF checks for domains they do not administer.","category":"infrastructure","nicknames":[],"who_cares":["self-hosted","mail-server","mailu","docker"],"confidence":0.6,"needs_auth":"yes","worst_case":"Domain admin sends DKIM and SPF authenticated mail as other domains.","analyst_note":"Find the fixed Mailu release version that contains commit f05aeb8322e2f61096af6b089d61ba6f40587d96 and the affected version range; check the Mailu security advisory.","how_to_check":"- Check the Mailu image version in your compose file or deployment, e.g. `docker compose images` or the tag of the mailu images.\n- Confirm whether the commit `f05aeb8322e2f61096af6b089d61ba6f40587d96` is included in the deployed Mailu build.","needs_analyst":true,"not_affected_if":["single-domain-deployment","no-domain-managers"],"who_is_affected":"Teams running Mailu as a multi-domain mail server where some users are domain managers for only some hosted domains. A single-domain installation with one administrator is far less exposed. The sources do not state the exact affected version range.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000652,"input_tokens":3366,"output_tokens":630,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-86009':15A,18A 'abl':120C 'address':125C 'administ':66B 'administr':98C 'anoth':47B,102C 'authent':111C 'check':60B 'control':12A,93C 'cve':13A,16A 'distribut':72C 'dkim':57B 'dkim/spf':113C 'docker':19B,38B,77C 'domain':2A,8A,41B,49B,62B,82C,89C,97C,104C,115C 'email':108C 'enabl':44B,85C,99C 'f05aeb8322e2f61096af6b089d61ba6f40587d96':81C,127C 'host':27B,33B,48B,88C,103C 'imag':39B,78C 'infrastructur':20B 'mail':6A,22B,34B,54B,70C 'mail-serv':21B 'mailu':1A,24B,28B,67C 'malici':96C 'manag':3A,42B,83C 'pass':56B 'potenti':95C 'prior':79C 'self':26B,32B 'self-host':25B,31B 'send':53B,107C 'server':23B,35B,71C 'set':75C 'ship':36B 'spf':59B 'spoof':5A,45B,86C,100C 'vulner':123C","nicknames":[],"mitigations":[],"who_affected":"Teams running Mailu as a multi-domain mail server where some users are domain managers for only some hosted domains. A single-domain installation with one administrator is far less exposed. The sources do not state the exact affected version range.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T17:17:51+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-86009","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86009","severity":null,"published_at":"2026-10-16T17:17:51+00:00","modified_at":"2026-10-21T03:17:19+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}