Mailpit

v1.29.2 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 3mo Communication & Email

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

This release patches 1 known CVE

Topics

email-testing go mailpit pop3-server smtp-relay smtp-server

+1 more

smtp-testing

Affected surfaces

rce_ssrf breaking_upgrade

Summary

AI summary

Updates Chore, Fix, and https://github.com/axllent/mailpit/security/advisories/GHSA-mpf7-p9x7-96r3 across a mixed release.

Full changelog

This release includes an important security fix, so upgrading is strongly recommended.

This security release fixes CVE-2026-27808: users could use the Link Check API to probe internal network IPs/hostnames. The exploit required user access to both the API and the SMTP server, so the risk is limited to users who have publicly-accessible Mailpit instances with no authentication on both the API and SMTP server.

Key change:

New opt-in flag: --allow-internal-http-requests (env MP_ALLOW_INTERNAL_HTTP_REQUESTS=true). When enabled, the Link Check API and UI screenshot proxy may access internal-network IPs.

Action required:

This is potentially breaking for test suites that depend on Link Check probing internal resources - review and update tests as needed.

A huge thanks to the security researcher (@rtvkiz) who reported this issue responsibly.

Changelog:

Security

Prevent Server-Side Request Forgery (SSRF) via Link Check API (CVE-2026-27808)

Chore

Upgrade eslint JavaScript linting
Update Go dependencies
Update node dependencies
Update caniemail test database

Fix

Update install instructions when setting INSTALL_PATH
Include 8BITMIME in SMTPD EHLO response (#648)

Breaking Changes

Link Check API now blocks internal‑network HTTP requests by default; existing tests that probe such resources will fail until `--allow-internal-http-requests` (or env `MP_ALLOW_INTERNAL_HTTP_REQUESTS=true`) is enabled.

Security Fixes

CVE-2026-27808 — Prevents Server‑Side Request Forgery (SSRF) via the Link Check API; requires upgrading and reviewing any test suites that relied on probing internal resources.

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track Mailpit

Get notified when new releases ship.

About Mailpit

Email testing tool and API for developers

All releases →