OpenProject Vulnerability in SMTP Test Endpoint Allows Internal Network Mapping

CVE-2026-31974

What is CVE-2026-31974?

OpenProject, an open-source project management tool, contains a vulnerability in its SMTP test endpoint prior to version 17.2.0. This issue allows attackers to input arbitrary host and port values, generating varying response behaviors based on the existence of the target IP and the state of the port. By leveraging these timing and error responses, attackers can effectively map internal network services and identify reachable ports. Moreover, the ability to create webhooks targeting arbitrary IPs exacerbates this risk, facilitating internal network scans and potential exposure to sensitive services.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References