External risk intelligence

mailcow Dockerized Domain Footer Command Execution

CVE advisorySeverity: CRITICAL (CVSS 9.4)

CVE-2026-125757

mailcow: dockerized is an email server suite designed to be internet-facing for the purpose of receiving, sending, and managing mail. While the vulnerability requires administrative privileges to exploit, the management interface for such software is commonly exposed to the internet or reachable through remote access gateways, making the attack surface readily accessible in many standard deployment patterns.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in mailcow:dockerized, an email server suite, allows domain administrators to execute commands on the shared rspamd container. This occurs when a malicious domain-wide footer is stored, enabling attackers to potentially read or inject mail for all tenants and disable filtering. The main concern is confirming relevance and exposure.

Stored footer allows command execution.
Affects mail administrators, impacts tenants.
Confirm relevance and review footer settings.

Attack Path

How an attacker could exploit the issue

An attacker with administrative access to mailcow:dockerized can exploit a server-side template injection vulnerability by configuring a malicious domain-wide footer. This crafted footer, containing a Jinja macro with an `os.execute` command, will be processed by the rspamd MOO_FOOTER prefilter. When rendered, this macro allows the attacker to execute commands within the shared rspamd container, potentially leading to the compromise of mail for all tenants and the disabling of email filtering services.

Requires administrative privileges.
Triggered by storing a malicious domain footer.
Risk of command execution and service disruption.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow a malicious actor with administrative access to execute commands on the shared rspamd container. This could impact all tenants by enabling unauthorized access to read or inject mail, and potentially disable filtering services.

System data and service behavior at risk.
Command execution via malicious domain footer.
Loss of mail filtering and data integrity.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in mailcow:dockerized affects domain administrators, indicating that platform or infrastructure teams managing mailcow deployments are likely responsible for remediation. The initial step should be to identify all mailcow instances, confirm their exposure and criticality, and then map them to accountable owners before planning any necessary updates or mitigation strategies.

Platform/Infrastructure teams own remediation.
Verify mailcow instance reachability and criticality.
Plan updates during scheduled maintenance windows.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is mailcow: dockerized?

mailcow: dockerized is a comprehensive, open-source email server suite. It bundles essential mail services—like Postfix for delivery, Dovecot for storage, and Rspamd for spam filtering—into a set of interconnected containers. Administrators use it to manage email domains, users, and security policies through a centralized, web-based interface.

What does server-side template injection mean in CVE-2026-125757?

This is a vulnerability class where an application accidentally treats user-supplied data as executable code. In this specific case, the software uses a template engine to process email footers. By crafting a footer containing specific macro syntax, an attacker can trick the system into running unintended commands instead of just displaying text.

How is this vulnerability triggered?

An attacker must have administrative access to the mailcow management interface to change a domain-wide footer. They inject a Jinja macro designed to invoke operating system commands. This bug is not triggered by standard email traffic or user-level actions; it requires the explicit configuration of a malicious footer to execute.

Is my instance at risk according to Halo Surface Signal?

Because mailcow: dockerized is typically internet-facing to handle email traffic, Halo Surface Signal flags this as an external risk. If your management interface is reachable over the network, an administrator account—if compromised—could be used to exploit this vulnerability remotely.

What are the first steps to address CVE-2026-125757?

Your priority is to ensure your software is updated to the version released in November 2026, which contains the fix. Until you can patch, verify that your mailcow management interface is not exposed to the public internet and limit access to only trusted network segments. Review current domain footer configurations for any unexpected or suspicious code.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.