# CVE-2026-21859: Mailpit - SSRF

> Live exploitation tracking for CVE-2026-21859 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2026-21859

## Key facts

- **Exploitation phase:** Background Noise. Continuous low-level scanning or exploitation attempts are observed, mostly opportunistic and automated.
- **CVSS score:** 5.8
- **Public exploit available:** Yes
- **Affected products:** Axllent Mailpit
- **Weaknesses:** CWE-918 (Server-Side Request Forgery (SSRF))
- **Tags:** mail

## Description

Mailpit is an email testing tool and API for developers. Versions 1.28.0 and below have a Server-Side Request Forgery (SSRF) vulnerability in the /proxy endpoint, allowing attackers to make requests to internal network resources. The /proxy endpoint validates http:// and https:// schemes, but it does not block internal IP addresses, enabling attackers to access internal services and APIs. This vulnerability is limited to HTTP GET requests with minimal headers. The issue is fixed in version 1.28.1.

## CrowdSec analysis

[CVE-2026-21859](https://euvd.enisa.europa.eu/vulnerability/CVE-2026-21859) is a Server-Side Request Forgery (SSRF) vulnerability in Mailpit versions 1.28.0 and below, which allows remote attackers to exploit the /proxy endpoint to access internal network resources. By leveraging this flaw, attackers can send unauthorized HTTP GET requests to internal services and APIs, potentially exposing sensitive information or internal infrastructure details. The vulnerability is addressed in version 1.28.1.

CrowdSec has been tracking this vulnerability and its exploits since 11th of February 2026.

CrowdSec network data shows that most actors exploiting CVE-2026-21859 rely on broad, untargeted scans with minimal filtering. The activity is largely automated and opportunistic in nature.
CrowdSec network telemetry also shows that exploitation of CVE-2026-21859 has significantly declined over the past week. Attack volumes are well below the long-term average, suggesting attackers are rapidly losing interest. The vulnerability appears to be falling out of active use across most threat landscapes.

Attackers exploit the `/proxy` endpoint by sending crafted requests with the `url` parameter targeting internal IP addresses, such as `127.0.0.1`, to trigger server-side request forgery and access internal network resources.

## Timeline

- 2026-01-07: CVE Published. CVE-2026-21859 is published to NVD.
- 2026-02-11: Rule Released. CrowdSec releases a rule to detect CVE-2026-21859 exploitation attempts against the CrowdSec Network.
- 2026-02-11: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2026-21859 for the first time.

## References

- https://github.com/axllent/mailpit/security/advisories/GHSA-8v65-47jx-7mfr
- https://github.com/axllent/mailpit/commit/3b9b470c093b3d20b7d751722c1c24f3eed2e19d
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-21859.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2026-21859) follows observed exploitation activity for CVE-2026-21859. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.