CVE-2026-86009

— UNSCOREDpublic exploit available

Published 2026-10-16 · Updated 2026-10-16

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

Mailu is a mail server distributed as a set of Docker images. Prior to f05aeb8322e2f61096af6b089d61ba6f40587d96, domain managers can enable spoofing for hosted domains they do not control. A potentially malicious domain administrator enables spoofing for another hosted domain and can send emails that are authenticated with DKIM/SPF for domains they should not be able to. This vulnerability is addressed by f05aeb8322e2f61096af6b089d61ba6f40587d96.

Weaknesses

CWE-285, CWE-863

Public exploit & PoC references

https://github.com/Mailu/Mailu/commit/f05aeb8322e2f61096af6b089d61ba6f40587d96
https://github.com/Mailu/Mailu/issues/2686
https://github.com/Mailu/Mailu/pull/4072
https://github.com/Mailu/Mailu/security/advisories/GHSA-crww-m82r-2wfm

All references

https://github.com/Mailu/Mailu/commit/f05aeb8322e2f61096af6b089d61ba6f40587d96
https://github.com/Mailu/Mailu/issues/2686
https://github.com/Mailu/Mailu/pull/4072
https://github.com/Mailu/Mailu/security/advisories/GHSA-crww-m82r-2wfm

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

MEDIUMCVE-2026-101006
MEDIUMCVE-2026-105703PoC
MEDIUMCVE-2026-18773PoC
UNSCOREDCVE-2026-70472PoC
UNSCOREDCVE-2026-71886PoC
UNSCOREDCVE-2026-86101
MEDIUMCVE-2026-93954PoC
MEDIUMCVE-2023-54410PoC

Related by shared AI tags and CWE weakness class. Browse the full archive.