Mailu: Domain managers can enable spoofing for foreign hosted domains
Summary
Mailu is a mail server distributed as Docker images. Before the fix commit, a domain manager can enable the allow_spoofing flag for users and thereby permit spoofing of senders on hosted domains they do not control. Messages sent this way can pass DKIM and SPF checks for those domains, which makes phishing from trusted domains easier. Exploitation requires a valid domain manager account (high privileges).
Affected
- Mailu versions before commit f05aeb8322e2f61096af6b089d61ba6f40587d96
- Exact released versions: Unknown.
Fixed in
- Commit f05aeb8322e2f61096af6b089d61ba6f40587d96 restricts allow_spoofing to the sender's own domain.
- First fixed release: Unknown. Check the Mailu release notes and GHSA-crww-m82r-2wfm.
Workaround
- Unknown. No vendor workaround was found.
- Partial measure: limit domain manager rights and review which users have allow_spoofing enabled.
Exploitation
- No confirmed exploitation in the wild. CISA KEV status not found.
- CISA SSVC: exploitation PoC, not automatable.
- Public PoC status is unverified.
- EPSS is low (about 0.003).
Our recommendation
- Identify whether your Mailu instance hosts several domains with delegated domain managers.
- Upgrade to the first Mailu release containing commit f05aeb8, and patch CVE-2026-86008 at the same time.
- Review domain manager accounts and allow_spoofing settings now.
- Check mail logs for unexpected From domains.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Mailu fix commit f05aeb8 github.com
- Mailu issue #2686 github.com
- Mailu pull request #4072 github.com
- GitHub Security Advisory GHSA-crww-m82r-2wfm github.com
- CVE-2026-86009 on Vulners vulners.com
- CVE-2026-86009 on threatint cve.threatint.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 15:53.
Original description (NVD)
Mailu is a mail server distributed as a set of Docker images. Prior to f05aeb8322e2f61096af6b089d61ba6f40587d96, domain managers can enable spoofing for hosted domains they do not control. A potentially malicious domain administrator enables spoofing for another hosted domain and can send emails that are authenticated with DKIM/SPF for domains they should not be able to. This vulnerability is addressed by f05aeb8322e2f61096af6b089d61ba6f40587d96.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.