sagredo qmail before 2026.04.07 allows tls_quit remote code execution because of popen in notlshosts_auto in qmail-remote.c.

Successful exploitation of CVE-2026-41113 allows an attacker to execute arbitrary code on the affected qmail server with the privileges of the qmail process. This could lead to complete system compromise, including data exfiltration, malware installation, and denial of service. Given that qmail is often used in critical email infrastructure, a successful attack could disrupt email services and expose sensitive data. The ability to execute arbitrary code opens the door to lateral movement within the network, potentially compromising other systems accessible from the mail server. The blast radius extends to any data processed or stored by the mail server, including user credentials, email content, and configuration files.

Organizations running qmail mail servers, particularly those with publicly accessible instances or those handling sensitive email data, are at risk. This includes small businesses, non-profit organizations, and larger enterprises relying on qmail for their email infrastructure. Systems with outdated qmail installations and inadequate network security controls are particularly vulnerable.

• linux / server:

journalctl -u qmail | grep -i tls_quit

• linux / server:

lsof -i :25 | grep qmail

• linux / server:

ps aux | grep qmail

1. 2026-04-16Disclosure

   disclosure

1. Reserviert2026-04-16
2. Veröffentlicht2026-04-16
3. Geändert2026-04-18
4. EPSS aktualisiert2026-04-24

The primary mitigation for CVE-2026-41113 is to upgrade to qmail version 2026.04.07 or later. If an immediate upgrade is not possible, consider implementing temporary workarounds such as restricting network access to the qmail server using a firewall or Web Application Firewall (WAF) to limit potential attack vectors. Carefully review and restrict the permissions granted to the qmail user account to minimize the impact of a potential compromise. Monitor system logs for suspicious activity related to the tlsquit command or unexpected process executions. After upgrading, confirm the fix by attempting to trigger the vulnerable tlsquit sequence and verifying that it no longer results in code execution.