hMailServer: Improper certificate validation of database connection
Summary
hMailServer 6.3.4 through 6.3.7 does not verify the certificate of the MySQL or MariaDB database server when TlsMode is set to verify-full, no TlsCaFile is configured and Server points to a local address (127.0.0.1, ::1, localhost, a Unix socket, a named pipe or a list containing such an entry). A local attacker who can impersonate the database server, for example by listening on its port while it is stopped or restarting, can receive the database sign-in including the password and read and modify the traffic. The application log and the check-database output nevertheless report that the certificate was checked.
Affected
- hMailServer 6.3.4 to 6.3.7 (Windows bundles MariaDB Connector/C 3.4.9 for 6.3.4 to 6.3.6 and 3.4.11 for 6.3.7; Linux uses the distribution's client)
- Only with MySQL or MariaDB, TlsMode=verify-full, no TlsCaFile and a local Server= value
- Default configuration (TlsMode=prefer) is not affected
Fixed in
- Upgrade to hMailServer 6.3.8
Workaround
- Set TlsCaFile to a file containing only the CA that issues the database server's certificate, using a path with ASCII characters only. This checks the certificate's issuer on local connections, but not its name.
- Until the upgrade, do not use TlsMode=verify-full without TlsCaFile on local connections.
Exploitation
Unknown.
Our recommendation
- Upgrade to hMailServer 6.3.8 as soon as possible.
- Until then, configure TlsCaFile as described above.
- Check hMailServer.ini for TlsMode=verify-full without TlsCaFile on systems with MySQL or MariaDB.
- Restrict local access to the database server and the host, and rotate the database password if an unauthorised local user may have had access.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- hMailServer 6.3.8 release gitlab.com
- hMailServer issue #113 (Database TLS) gitlab.com
- CVE Record CVE-2026-126611 www.cve.org
- VulDB entry 435710 vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 10:31.
Original description (NVD)
Progressive Robot hMailServer 6.3.4 through 6.3.7, with a MySQL or MariaDB database, TlsMode=verify-full and no TlsCaFile, does not verify the database server's certificate's issuer or name when the connection is one that MariaDB Connector/C treats as local - Server= set to 127.0.0.1, ::1 or localhost (on Linux a Unix socket), to . on Windows (a named pipe), or to a comma-separated list of servers that holds such an element - which allows a local attacker who can stand in for the database server, for example by listening on its port while it is stopped or restarting, to receive the database sign-in, the password included, and to read and modify the traffic between hMailServer and its database. hMailServer applied verify-full by turning the client's certificate verification on without a CA file, but MariaDB Connector/C 3.4.1 and later, on a connection they treat as local and with no CA file, accept any certificate within its validity period that is self-signed or sent with its own root, for any name (Connector/C 3.4.2 to 3.4.10 also one whose issuer they cannot find), so the client accepted the certificate an impostor made, asked no proof of the password and allowed a switch to an authentication method that sends the password unhashed, while hmailserver --check-database said the certificate had been checked against the system's trust store and the application log that it had been checked. The Windows builds bundle Connector/C 3.4.9 (6.3.4 to 6.3.6) and 3.4.11 (6.3.7); on Linux the distribution's client is used, and Connector/C 3.3 and 3.4.0 and Oracle's MySQL client are not affected. The configuration is not the default: TlsMode defaults to prefer, which checks no certificate.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.