CVE-2026-125757

Summary

A server-side template injection (CWE-1336) in mailcow before 2026-11 allows domain administrators to inject malicious Jinja macros into domain-wide footers, which are rendered by the rspamd MOO_FOOTER prefilter, enabling arbitrary command execution in the shared rspamd container. This bypasses tenant isolation and allows attackers to read or inject mail for all tenants and disable spam filtering.

Exploitability

Exploitation requires domain administrator privileges and knowledge of the vulnerable rspamd prefilter configuration; no external authentication bypass is needed beyond valid admin credentials.

Blast radius

Successful exploitation compromises all mailboxes and filtering across all tenants sharing the same rspamd instance, enabling full data exfiltration, mail injection, and persistent filter disabling.

Detection

Defenders should monitor rspamd logs for unexpected os.execute() calls or suspicious macro invocations in MOO_FOOTER context; additionally, inspect mailcow admin activity logs for creation or modification of domain-wide footers containing Jinja syntax with dangerous functions like {{ ''.__class__.__mro__[1].__subclasses__() }} or os.execute().

Prioritized remediation

Upgrade to mailcow dockerized 2026-11 or later, which patches the template injection in the domain footer rendering logic.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.