---
id: "CVE-2026-86009"
kind: "vulnerability"
aliases: ["CVE-2026-86009"]
title: "Mailu: domain managers can spoof mail for domains they do not control"
severity: "high"
cvss: 8.2
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["docker", "infrastructure", "mail-server", "mailu", "self-hosted"]
not_affected_if: ["no-domain-managers", "single-domain-deployment"]
published_at: "2026-10-16T17:17:51+00:00"
first_seen_at: "2026-10-23T21:57:13+00:00"
updated_at: "2026-10-25T03:04:30+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86009", "first_seen_at": "2026-10-23T21:57:13+00:00"}]
---

# Mailu: domain managers can spoof mail for domains they do not control

Mailu is a self-hosted mail server shipped as Docker images. A domain manager can enable spoofing for another hosted domain, so they can send mail that passes DKIM and SPF checks for domains they do not administer.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the Mailu image version in your compose file or deployment, e.g. `docker compose images` or the tag of the mailu images.
- Confirm whether the commit `f05aeb8322e2f61096af6b089d61ba6f40587d96` is included in the deployed Mailu build.

## Fix

- Update Mailu to a build that includes commit `f05aeb8322e2f61096af6b089d61ba6f40587d96`; the fixed release version is unknown from the sources.
- Review existing domain manager accounts and any spoofing settings enabled on hosted domains.

## Timeline

- 2026-10-23T21:57:13+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-86009

## From the sources

Mailu is a mail server distributed as a set of Docker images. Prior to f05aeb8322e2f61096af6b089d61ba6f40587d96, domain managers can enable spoofing for hosted domains they do not control. A potentially malicious domain administrator enables spoofing for another hosted domain and can send emails that are authenticated with DKIM/SPF for domains they should not be able to. This vulnerability is addressed by f05aeb8322e2f61096af6b089d61ba6f40587d96.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_