CVE-2026-27851: SQL/LDAP Injection in OX Dovecot Pro

The vulnerability allows an attacker to inject malicious SQL or LDAP code into authentication processes. Successful exploitation could lead to unauthorized access to sensitive data, including user credentials, email content, and potentially system configuration information. The impact is particularly severe if Dovecot Pro is integrated with other systems, as a compromised Dovecot instance could serve as a pivot point for lateral movement within the network. While no public exploits are known, the potential for SQL/LDAP injection makes this a high-risk vulnerability, especially in environments where Dovecot Pro handles sensitive user data.

1. Publicada2026-05-12

The primary mitigation is to upgrade to OX Dovecot Pro version 3.1.5 or later, which addresses the underlying issue. If immediate upgrading is not feasible, the 'safe filter' should be disabled until patching can be performed. This will prevent the vulnerable pipeline interpretation. Consider implementing stricter input validation and sanitization on any data used within Dovecot Pro's authentication pipelines as an additional layer of defense. Monitor Dovecot Pro logs for any suspicious activity or unusual authentication attempts. After upgrading, confirm the fix by attempting to trigger the vulnerable pipeline with malicious input and verifying that it is properly sanitized.