Local Certificate Verification Flaw in hMailServer from Progressive Robot
CVE-2026-126611

7HIGH

Key Information:

Vendor

Progressive Robot Ltd

Status
Hmailserver
Vendor
CVE Published:
11 November 2026

What is CVE-2026-126611?

hMailServer versions 6.3.4 to 6.3.7 contain a vulnerability where the database connection does not properly verify the issuer or name of the database server's certificate when connecting locally. This occurs when the TlsMode is set to 'verify-full' without specifying a TlsCaFile. Local attackers can exploit this issue by impersonating the database server, potentially capturing sensitive information such as database credentials and allowing traffic manipulation between hMailServer and its database. The configuration is non-default, as TlsMode defaults to 'prefer', which does not check certificates. Windows builds shipped with MariaDB Connector/C versions 3.4.9 and 3.4.11 are affected, while certain clients, including Connector/C 3.3 and 3.4.0 as well as Oracle's MySQL client, are not.

Affected Version(s)

hMailServer 6.3.4 <= 6.3.7

References

https://gitlab.com/hmailserver/hmailserver/-/work_items/113
https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.8

CVSS V3.1

Score:
7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Found by the hMailServer project (Progressive Robot Ltd)
.