Mailu has 3 CVEs on record. 3 were published in the last 90 days. The median CVSS is 8.2 (high), with 1 rated critical.
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 8.2
- Publish → KEV
- —
- Last 90 days
- 3 prev 0
Worst active — by depth score
Mailu vulnerabilities
CVEs affecting Mailu, newest first. Open any entry for full detail, references, and exploit status.
3 CVEsRSS
CVE-2026-86008High· 7.2Mailu is a mail server distributed as a set of Docker images
Mailu is a mail server distributed as a set of Docker images. Prior to 8577c929b4ade04d3cd4210cf036601abd793556, a domain manager targeting an administrative account or another domain manager with greater privileges can reset passwords o…
CVE-2026-86009High· 8.2PoCMailu: Domain managers can allow themselves to spoof on other hosted domains they should not control
Mailu is a mail server distributed as a set of Docker images. Prior to f05aeb8322e2f61096af6b089d61ba6f40587d96, domain managers can enable spoofing for hosted domains they do not control. A potentially malicious domain administrator ena…
CVE-2026-85751Critical· 9.8Mailu is a mail server distributed as a set of Docker images
Mailu is a mail server distributed as a set of Docker images. From Mailu 2.0 until 2024.06.55 and prior to Mailu helm-charts 2.7.3, deployments with PROXY_AUTH_WHITELIST configured but REAL_IP_HEADER unset trusted a client-controlled X-F…