Skip to content

hMailServer wave (~20 GHSAs): loopback REST reachable by browser rebinding

Wave in one line: COM service as a local-privilege surface, loopback REST reachable by browser rebinding, and DANE/TLS fail-open on the outbound mail path

Source: hourly offensive-security scan of GitHub Security Advisories, 2026-10-08 (wave published 2026-10-08T12:34Z, ~20 advisories for Progressive Robot hMailServer, CVE-2026-107503-adjacent band CVE-2026-107570–107587 plus CVE-2026-103010/103011/103517-adjacent CVE-2026-103647/103649/104658/104659/104660; affected band 6.0.0 through 6.3.5, webmail legs 6.3.2–6.3.5).

One theme: a mail server aggregates DNS trust, TLS trust, attachment handling, a Windows COM service, and a loopback admin API in one process — and this wave breaks every one of those boundaries independently. hMailServer is a very common Windows mail server in SMB and MSP environments; the wave is a ready-made test matrix for any authorized engagement where a mail host is in scope, and several legs generalize to any mail server or any Windows service that registers COM classes.

Advisory table (affected band: hMailServer 6.0.0–6.3.5)

Leg GHSA CVE Sev Boundary
DANE fail-open on outbound SMTP GHSA-m2j8-89fm-cxjh CVE-2026-107584 7.4 The validating DNSSEC resolver treated a TLSA/MX lookup that did not complete (no answer, SERVFAIL, malformed reply), an answer lacking NSEC/NSEC3 absence proofs, and records with no applicable RRSIG as "domain unsigned" — and from 6.2.19 delivered to MX hosts from an unvalidated MX set. Path/resolver attacker + SMTP-path position ⇒ DANE silently disabled for a DNSSEC-signed recipient.
DANE-TA-only TLSA ⇒ opportunistic TLS GHSA-gv77-q2r2-h9qj CVE-2026-104704 high Only DANE-EE (usage 3) records were honored; a validated TLSA set of DANE-TA (usage 2) or otherwise-unusable records was treated as no records, so delivery fell back to opportunistic TLS — active path attacker suppresses STARTTLS, mail flows cleartext.
Loopback REST admin via DNS rebinding GHSA-7264-4fp3-6f67 CVE-2026-104659 high The REST API listener (off by default, loopback-bound when on) answered requests whatever the Host header named, and failed admin sign-ins from loopback were neither auto-banned nor delayed. A rebinding page opened in a browser on the server brute-forces the administrator password at full speed → full admin control.
COM objects with no DCOM authorization GHSA-p223-vjjq-q36p CVE-2026-104660 high COM classes registered with no DCOM access/launch permissions and CoInitializeSecurity with no security descriptor: any local console/RDP user activates hMailServer.Message, Attachments, FetchAccount in the running service — arbitrary file read/write as the service account (Attachments.Add(path), Attachment.SaveAs(path), Message.Save) and queue mail as any sender with a credential that never authenticated.
Root update helper trusts service-account file GHSA-xp25-6qr3-8c27 CVE-2026-104658 high Linux hmailserver-update runs as root on a request file written by the unprivileged service account and takes from it which program verifies the AppImage signature and which systemd unit to stop — service-account compromise ⇒ root code execution (path-unit active by default in .deb/.rpm).
Admin CLI follows junctions/mount points GHSA-f2xp-4p4c-fpc3 CVE-2026-107578 med Installer/DBSetup/Control-Panel admin-rights operations wrote logs, cert+private key, and message files into folders the service account can modify, following junctions/mount points, and store-maintenance reached files by names taken from the service-writable database ⇒ service-account-to-administrator escalation.
Installer default folder permissions GHSA-6v8h-9479-g4ch CVE-2026-107573 high data/log/temp/db folders and hMailServer.INI inherit Program Files defaults giving local Users read: every stored message, logs, account password hashes (DB readable while service stopped), and the config file's database password (sealed only with the machine key).
Webmail decrypted-attachment XSS GHSA-xr9h-mj6v-hm4m CVE-2026-103647 high S/MIME/OpenPGP parts decrypted in-browser were offered as blob URLs with the message-declared media type; opening a text/html part in a new tab rendered it in the webmail origin — script reads the mailbox, sends mail, changes the account via the REST API. Reachable with an encrypted message (decrypt-then-open is a higher click-through than a plain lure).
Untrusted signer cert poisoning reply encryption GHSA-j6xf-vpp5-5357 CVE-2026-107587 med Webmail kept a signer's certificate for encrypting replies whether or not the chain validated, keyed on the first e-mail address in the certificate rather than the message From. Later encrypted mail to that address was also encrypted to the attacker key ⇒ silent long-term confidentiality break on a correspondence.
Legacy Blowfish heap overflows GHSA-mgwr-8mph-vj23 / GHSA-46vr-9694-qxgc CVE-2026-103010 / CVE-2026-103011 high/med Heap overflow in BlowFishEncryptor::Decode/Encode legacy routine — pre-auth-adjacent parser memory-safety on the mail path.
Admin troubleshooting argument injection GHSA-hgvr-pf8h-6rjx CVE-2026-107510 9.1 Authenticated high-privilege user injects arguments into troubleshooting commands ⇒ privilege escalation. Detail-free GHSA (no package info); appliance-style troubleshooting-tool argument-injection class.

Tracked in-wave, no standalone publish: quadratic-complexity DoS pack (FETCH/SEARCH parsers [GHSA-45mp-xx9j-6p9v], DKIM/ARC [GHSA-6pj8-9c42-v5rp], MIME non-terminating loop [GHSA-q3hj-9493-685w], Sieve [GHSA-cqgg-3g6j-wqjp], JSON reader [GHSA-2c7f-jhwj-7q7h], header decode [GHSA-6877-qwxc-rh5c], SPF macro [GHSA-qcpx-92mh-q44f], bounce/complaint [GHSA-7658-76c6-34x2]), missing Linux network timeouts [GHSA-69m7-r4p2-rfcq], Content-Type OOB [GHSA-3756-2mxq-33pr] — all availability-class, folded into the fuzzing note below.

Why this is an operator page

Mail servers are dense trust-boundary hosts: they consume untrusted DNS answers, untrusted certificate material, untrusted attachment bytes, and untrusted network input in one privileged process, and they usually run on Windows hosts that are also domain members. The wave hands you a replayable checklist:

  1. Windows COM services are a standing local-privilege surface. Any Windows service that registers COM classes deserves a DCOM-permission audit — Win32_DCOMApplication/SD checks, or just try activation from a foothold account. Service-privileged file read/write (Attachments.Add/SaveAs shapes) plus unauthenticated send-as-any-sender is a full credential-theft + pivot kit on a mail host, from a lowest-privilege interactive login, with no hMailServer credential at all. Grep the registry AppID/AccessPermission keys, not the vendor docs.
  2. Loopback-bound admin listeners are browser-reachable without any Host check. The listener here validated nothing on Host and applied no loopback rate limit — the DNS-rebinding class the July 8 page tracks (folded there for the rebinding mechanics). Test: from an owned rebinding domain, drive a lab browser on the target host and watch whether the loopback API answers with a foreign Host; also confirm whether failed local logins burn the account or run unthrottled. Unthrottled loopback auth = a web page becomes a password oracle.
  3. Update helpers that run as root and read unprivileged files invert the trust direction. On any Linux service with a privileged updater, read the helper first and ask which fields it takes from files the service user writes — here the signature-verification program itself was attacker-chosen, so "verified signature" was theater. General rule: the verifier binary/path must never be data from a lower trust tier.
  4. Windows path-reparse trust: admin-rights tools operating in service-writable folders. Junction/mount-point following by elevated install/maintenance operations over directories a low-priv account can modify is the same reparse-point genealogy as symlink LPEs on the Sept 23 updater page — check log/cert/data folder ACLs on any appliance-style Windows service.
  5. DNSSEC/DANE fail-open is a durable mail-path interception primitive. Both TLS legs are validation-to-decision drift: an incomplete or unusable secure answer selects the insecure delivery path instead of the fail-closed path. If you hold an on-path position (network, resolver, or between resolver and authoritative NS), test DANE behavior by serving TLSA sets that are (a) DANE-TA-only, (b) RRSIG-stripped, (c) SERVFAIL/dropped, and observe whether STARTTLS is still required. Any mail stack that maps "secure data unavailable" to "not secured" is downgradable — check Postfix/exim/sendmail DANE patches similarly.
  6. Decrypt-then-render is a new webmail sink context. Browser-side S/MIME/OpenPGP decryption that hands plaintext parts back as blob URLs with attacker-declared media types puts decrypted content in the web app's own origin — and encryption raises click-through. Probe any webmail that decrypts client-side: request a decrypted attachment declared text/html, open in new tab, observe origin. Pair with the cert-store poisoning leg: auto-saved signer certs (trusted or not) silently steer future reply encryption — after receiving an encrypted correspondence test, inspect the per-contact certificate set.
  7. The quadratic-complexity pack is the fuzzing map. Twelve parser legs (FETCH/SEARCH, DKIM/ARC verify, MIME, Sieve, SPF macros, JSON, header decode, bounce processing) tell you exactly where to point a mail-protocol fuzzer on any mail server: length- and repetition-sensitive parsing of inbound-signed data. Availability-only for reports, reachability-map for research.

Validation boundaries

Lab instances only (owned VMs, disposable mail domains with DNSSEC control for the DANE legs; owned rebinding domain + lab browser for the loopback leg; local foothold accounts you own for the COM leg). No production mail queues, no real user mailboxes, no cleartext capture of third-party mail, no send-as-any-sender against real domains — prove queue injection to yourself only. On third-party hosts, route-level evidence (version, listener presence, folder ACL read where permitted) stays inside scope; brute force and COM activation are lab-only assertions.

Cross-references