CVE-2026-76171

Summary

Apache James server versions prior to 3.9.1 contained improper validation in the JMAP webPush feature that allowed Server-Side Request Forgery (SSRF), enabling attackers to reach internal network addresses from the server.

Exploitability

Exploitation requires network access to the JMAP webPush endpoint and knowledge of internal IP ranges or services, but no authentication or user interaction is needed.

Blast radius

Successful exploitation could allow an attacker to probe or interact with internal services, potentially leading to data exfiltration or lateral movement within the internal network.

Detection

Defenders should monitor for outbound HTTP/HTTPS requests from the James server to non-public IP ranges (e.g., 10.x.x.x, 172.16.x.x–172.31.x.x, 192.168.x.x) or localhost addresses in JMAP-related logs; unusual timing or frequency of such requests may indicate SSRF attempts.

Prioritized remediation

Upgrade to Apache James server version 3.9.1 immediately.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.