Open Threat Alert

Server-Side Request Forgery (SSRF) is not the most common attack vector, yet it can have a severe impact when targeted toward a tool at the core of your infrastructure. The CrowdSec Network has detected a wave of exploitation attempts targeting CVE-2026-21859, a critical SSRF vulnerability in Mailpit.
Key findings

CrowdSec first detected exploitation attempts targeting this vulnerability on February 11, 2026.
Attacks observed so far are highly selective and intelligence-driven, suggesting that threat actors are conducting sophisticated reconnaissance.
More than 130 IPs have been reported until now, with a clear uptick in malicious activity over the past week as awareness of the vulnerability grows.

How does CVE-2026-21859 work?

This vulnerability is a Server-Side Request Forgery (SSRF) flaw in Mailpit versions 1.28.0 and below. The issue lies in the /proxy endpoint, which is intended to proxy requests but fails to properly validate the destination monitoring.

Attackers can exploit this by sending crafted HTTP GET requests to the /proxy endpoint with a url parameter targeting internal IP addresses (e.g., 127.0.0.1 or internal metadata services). Because the application does not block internal destinations, it executes the request on behalf of the attacker, returning the response from the internal service. This allows unauthorized mapping of internal networks and potential access to sensitive data.