Mailpit Stop: Crashing the Localhost Party with CVE-2026-22689
Jan 13, 2026·6 min read·9 visits
Executive Summary (TL;DR)
A critical flaw in Mailpit's WebSocket configuration disabled Origin validation. This allows any website visited by a developer to open a WebSocket connection to their local Mailpit instance (usually `ws://localhost:8025`). Attackers can read all captured emails—password resets, 2FA codes, and PII—in real-time. The fix is a one-line code deletion that restores default security checks.
Mailpit, the beloved email testing tool for developers, inadvertently left the back door open to the entire internet. Through a Cross-Site WebSocket Hijacking (CSWSH) vulnerability, remote attackers could siphon sensitive emails directly from a developer's localhost environment simply by convincing them to visit a malicious webpage.
Official Patches
Fix Analysis (1)
Technical Appendix
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:NAffected Systems
Affected Versions Detail
| Product | Affected Versions | Fixed Version |
|---|---|---|
Mailpit axllent | < 1.28.2 | 1.28.2 |
| Attribute | Detail |
|---|---|
| CWE ID | CWE-1385 |
| Attack Vector | Network (CSWSH) |
| CVSS Score | 6.5 (Medium) |
| Impact | Confidentiality (High) |
| EPSS Score | 0.00015 |
| Exploit Status | PoC Available |
MITRE ATT&CK Mapping
Missing Origin Validation in WebSockets
Known Exploits & Detection
Vulnerability Timeline
Subscribe to updates
Get the latest CVE analysis reports delivered to your inbox.