---
id: CVE-2026-86009
title: >-
  Mailu: Domain managers can allow themselves to spoof on other hosted domains
  they should not control
summary: >-
  Mailu is a mail server distributed as a set of Docker images. Prior to
  f05aeb8322e2f61096af6b089d61ba6f40587d96, domain managers can enable spoofing
  for hosted domains they do not control. A potentially malicious domain
  administrator ena…
severity: high
cvss: 8.2
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N'
cvssSource: cna
cwe:
  - CWE-285
  - CWE-863
vendor: Mailu
product: Mailu
affected:
  - Mailu < f05aeb8322e2f61096af6b089d61ba6f40587d96
published: '2026-10-16'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T16:19:06.420Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-86009'
references:
  - url: 'https://github.com/Mailu/Mailu/security/advisories/GHSA-crww-m82r-2wfm'
    label: 'https://github.com/Mailu/Mailu/security/advisories/GHSA-crww-m82r-2wfm'
  - url: 'https://github.com/Mailu/Mailu/issues/2686'
    label: 'https://github.com/Mailu/Mailu/issues/2686'
  - url: 'https://github.com/Mailu/Mailu/pull/4072'
    label: 'https://github.com/Mailu/Mailu/pull/4072'
  - url: >-
      https://github.com/Mailu/Mailu/commit/f05aeb8322e2f61096af6b089d61ba6f40587d96
    label: >-
      https://github.com/Mailu/Mailu/commit/f05aeb8322e2f61096af6b089d61ba6f40587d96
tags:
  - cve.org
ingestedAt: '2026-10-16T17:24:46.886Z'
---

## Overview

Mailu is a mail server distributed as a set of Docker images. Prior to f05aeb8322e2f61096af6b089d61ba6f40587d96, domain managers can enable spoofing for hosted domains they do not control. A potentially malicious domain administrator enables spoofing for another hosted domain and can send emails that are authenticated with DKIM/SPF for domains they should not be able to. This vulnerability is addressed by f05aeb8322e2f61096af6b089d61ba6f40587d96.

## Affected

- `Mailu < f05aeb8322e2f61096af6b089d61ba6f40587d96`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.