{"id":"EUVD-2026-43052","enisaUuid":"c97776ef-07e3-3df7-89bd-e73608ea7725","description":"Mailpit is an email testing tool and API for developers. Prior to 1.30.2, the remediation shipped for CVE-2026-27808 is incomplete because the tools.IsInternalIP deny-list in internal/tools/net.go relies on Go\u0027s standard library classification helpers and does not block IPv6 transition mechanisms or prefixes such as NAT64, 6to4, IPv4-compatible IPv6, ISATAP, fec0::/10, and 2001:db8::/32. An attacker who can deliver email and invoke POST /api/v1/message/{ID}/link-check can coerce the Link Check API\u0027s safeDialContext path into dialing internal destinations and can use status-code and error feedback to map internal service reachability, including cloud metadata endpoints. This issue is fixed in version 1.30.2.","datePublished":"Jul 10, 2026, 9:43:59 PM","dateUpdated":"Jul 13, 2026, 3:55:15 PM","baseScore":5.8,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","references":"https://github.com/axllent/mailpit/security/advisories/GHSA-w4mc-hhc6-xp28\nhttps://github.com/axllent/mailpit/commit/a88dadbbe1df016a35a445089ef2a362a6c2de78\nhttps://github.com/axllent/mailpit/releases/tag/v1.30.2\n","aliases":"CVE-2026-55187\nGHSA-w4mc-hhc6-xp28\n","assigner":"GitHub_M","epss":0.35,"enisaIdProduct":[{"id":"a9ce9ea0-1fa6-39f4-a5db-676e9a4265c4","product":{"name":"mailpit","vendor":{"name":"axllent"}},"product_version":"\u003c 1.30.2"}],"enisaIdVendor":[{"id":"cbe010de-20f5-3eaa-b43a-aabc9b4a87e0","vendor":{"name":"axllent"}}],"enisaIdVulnerability":[{"id":"93b5a92d-6af7-3985-91e3-10da423d563c","vulnerability":{"id":"GHSA-w4mc-hhc6-xp28","description":"Mailpit: Incomplete SSRF protection in Link Check API via IPv6 transition mechanisms","datePublished":"Jun 19, 2026, 9:16:21 PM","dateUpdated":"Sep 2, 2026, 11:40:12 PM","baseScore":0.0,"references":"https://github.com/axllent/mailpit/security/advisories/GHSA-w4mc-hhc6-xp28\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-55187\nhttps://github.com/axllent/mailpit/commit/a88dadbbe1df016a35a445089ef2a362a6c2de78\nhttps://github.com/axllent/mailpit\nhttps://github.com/axllent/mailpit/releases/tag/v1.30.2\n","enisa_id":"EUVD-2026-43052\n","aliases":"CVE-2026-55187\nGHSA-w4mc-hhc6-xp28\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:01:46 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"a6ca4b04-4489-3ea6-819c-e1baea1d8587","vulnerability":{"id":"CVE-2026-55187","description":"Mailpit is an email testing tool and API for developers. Prior to 1.30.2, the remediation shipped for CVE-2026-27808 is incomplete because the tools.IsInternalIP deny-list in internal/tools/net.go relies on Go\u0027s standard library classification helpers and does not block IPv6 transition mechanisms or prefixes such as NAT64, 6to4, IPv4-compatible IPv6, ISATAP, fec0::/10, and 2001:db8::/32. An attacker who can deliver email and invoke POST /api/v1/message/{ID}/link-check can coerce the Link Check API\u0027s safeDialContext path into dialing internal destinations and can use status-code and error feedback to map internal service reachability, including cloud metadata endpoints. This issue is fixed in version 1.30.2.","datePublished":"Jul 10, 2026, 9:43:59 PM","dateUpdated":"Jul 13, 2026, 3:55:15 PM","status":"PUBLISHED","baseScore":5.8,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","references":"https://github.com/axllent/mailpit/security/advisories/GHSA-w4mc-hhc6-xp28\nhttps://github.com/axllent/mailpit/commit/a88dadbbe1df016a35a445089ef2a362a6c2de78\nhttps://github.com/axllent/mailpit/releases/tag/v1.30.2\n","enisa_id":"EUVD-2026-43052\n","assigner":"GitHub_M","epss":0.35,"dataProcessed":"Nov 1, 2026, 7:17:06 AM","vulnerabilityProduct":[{"id":"f634d601-1378-3f2d-a256-9dba8b6ba6fc","product":{"name":"mailpit","vendor":{"name":"axllent"}},"product_version":"\u003c 1.30.2"}],"vulnerabilityVendor":[{"id":"299dfaab-f4e3-3293-9206-0fe3ff2643ec","vendor":{"name":"axllent"}}]}}],"enisaIdAdvisory":[]}