{"uuid": "65cea352-a319-47df-84d3-1dc6f2f8d097", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-86009", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117451533829537712", "content": "CVE-2026-86009 Mailu: Domain managers can allow themselves to spoof on other hosted domains they should not control Mailu is a mail server distributed as a set of Docker images. Prior to f05aeb8322e2f61096af6b089d61ba6f40587d96, domain managers can enable spoofing for hosted domains they do not control. A potentially malicious domain administrator enables spoofing for another hosted domain and can send emails that are authenticated with DKIM/SPF for domains they should not be able to. This vulnerability is addressed by f05aeb8322e2f61096af6b089d61ba6f40587d96.\nhttps://www.cve.org/CVERecord?id=CVE-2026-86009https://github.com/Mailu/Mailu/security/advisories/GHSA-crww-m82r-2wfmhttps://github.com/Mailu/Mailu/issues/2686https://github.com/Mailu/Mailu/pull/4072https://github.com/Mailu/Mailu/commit/f05aeb8322e2f61096af6b089d61ba6f40587d96#Mailu#CVE_2026_86009#bot", "creation_timestamp": "2026-10-16T16:31:10.057493Z"}