CVE-2026-42008

A flaw was found in Dovecot. Forwarded information from a host listed as a trusted proxy is not properly separated from Dovecot's internal authentication fields. This allows a malicious host configured as a trusted proxy to inject values as internal authentication fields, enabling it to authenticate as any user without knowing their password. This vulnerability leads to unauthorized access and affects deployments where the password database honors a field that permits passwordless authentication.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, ensure that the auth_proxy_trusted_networks configuration in Dovecot is strictly limited to only trusted hosts that are fully under administrative control. Review and restrict the auth_proxy_trusted_networks setting in your Dovecot configuration (e.g., /etc/dovecot/conf.d/10-auth.conf or similar) to prevent unauthorized hosts from acting as trusted proxies. If trusted proxies are not required, remove this configuration entirely. A restart of the Dovecot service may be required for changes to take effect.