CVE-2026-27851: SQL/LDAP Injection in OX Dovecot Pro
Platform
linux
Component
dovecot
Fixed in
3.1.5
CVE-2026-27851 describes a SQL/LDAP injection vulnerability within OX Dovecot Pro. This flaw arises from an incorrect interpretation of pipelines when the 'safe filter' is utilized with variable expansion, allowing attackers to bypass security measures. Versions 0.0.0 through 3.1.4 are affected, and a fix is available in version 3.1.5. No public exploits are currently known.
Impact and Attack Scenarios
The vulnerability allows an attacker to inject malicious SQL or LDAP code into authentication processes. Successful exploitation could lead to unauthorized access to sensitive data, including user credentials, email content, and potentially system configuration information. The impact is particularly severe if Dovecot Pro is integrated with other systems, as a compromised Dovecot instance could serve as a pivot point for lateral movement within the network. While no public exploits are known, the potential for SQL/LDAP injection makes this a high-risk vulnerability, especially in environments where Dovecot Pro handles sensitive user data.
Exploitation Context
CVE-2026-27851 was published on May 12, 2026. It is not currently listed on KEV (Kernel Exploit Vulnerability) or EPSS (Exploit Prediction Scoring System), suggesting a low to medium probability of exploitation. No public proof-of-concept (POC) code is currently available. Organizations should prioritize patching to mitigate the potential risk, especially given the sensitivity of data typically handled by email servers.
Threat Intelligence
Exploit Status
CVSS Vector
What do these metrics mean?
- Attack Vector
- Network — remotely exploitable over the internet. No physical or local access required. Widest attack surface.
- Attack Complexity
- High — requires a race condition, non-default configuration, or specific circumstances. Harder to exploit reliably.
- Privileges Required
- None — unauthenticated. No login or credentials needed to exploit.
- User Interaction
- None — attack is automatic and silent. Victim does nothing: no click, no file open.
- Scope
- Unchanged — impact is limited to the vulnerable component itself.
- Confidentiality
- High — complete confidentiality loss. Attacker can read all data: credentials, keys, personal data.
- Integrity
- High — attacker can write, modify, or delete any data: databases, config files, or code.
- Availability
- None — no availability impact. Service remains fully operational.
Affected Software
Weakness Classification (CWE)
Timeline
- Published
Mitigation and Workarounds
The primary mitigation is to upgrade to OX Dovecot Pro version 3.1.5 or later, which addresses the underlying issue. If immediate upgrading is not feasible, the 'safe filter' should be disabled until patching can be performed. This will prevent the vulnerable pipeline interpretation. Consider implementing stricter input validation and sanitization on any data used within Dovecot Pro's authentication pipelines as an additional layer of defense. Monitor Dovecot Pro logs for any suspicious activity or unusual authentication attempts. After upgrading, confirm the fix by attempting to trigger the vulnerable pipeline with malicious input and verifying that it is properly sanitized.
How to fix
Actualice a la versión 3.1.5 o superior para mitigar la vulnerabilidad. La versión 2.4.4 también corrige el problema. Esta actualización corrige una falla de interpretación incorrecta de los filtros seguros, lo que permite inyecciones SQL/LDAP.
Frequently asked questions
What is CVE-2026-27851 — SQL/LDAP Injection in OX Dovecot Pro?
CVE-2026-27851 is a HIGH severity vulnerability in OX Dovecot Pro versions 0.0.0–3.1.4. It allows attackers to inject malicious SQL or LDAP code via misuse of the 'safe filter', potentially leading to unauthorized access to sensitive data.
Am I affected by CVE-2026-27851 in OX Dovecot Pro?
If you are running OX Dovecot Pro versions 0.0.0 through 3.1.4 and are using the 'safe filter', you are potentially affected by this vulnerability. Upgrade to version 3.1.5 or later to mitigate the risk.
How do I fix CVE-2026-27851 in OX Dovecot Pro?
The recommended fix is to upgrade to OX Dovecot Pro version 3.1.5 or later. As a temporary workaround, disable the 'safe filter' until patching can be performed.
Is CVE-2026-27851 being actively exploited?
Currently, no public exploits are known for CVE-2026-27851. However, the potential for SQL/LDAP injection warrants prompt patching to prevent future exploitation.
Where can I find the official OX Dovecot Pro advisory for CVE-2026-27851?
Please refer to the official OX website and security advisories for the most up-to-date information regarding CVE-2026-27851 and OX Dovecot Pro: [https://www.ox.com/](https://www.ox.com/)
Is your project affected?
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.
Try it now — no account
Upload any manifest (composer.lock, package-lock.json, WordPress plugin list…) or paste your component list. You get a vulnerability report instantly. Uploading a file is just the start: with an account you get continuous monitoring, Slack/email alerts, multi-project and white-label reports.
Drag & drop your dependency file
composer.lock, package-lock.json, requirements.txt, Gemfile.lock, pubspec.lock, Dockerfile...