rootpwn

high · CVSS v3 7.3

CVE-2026-101281

OpenDMARC versions up to 1.4.2 contain a flaw in the SPF Macro Handler that allows remote attackers to manipulate authentication, potentiall

Overview

OpenDMARC versions up to 1.4.2 contain a flaw in the SPF Macro Handler that allows remote attackers to manipulate authentication, potentially enabling spoofed email delivery. The vulnerability can lead to improper mail-from domain verification. A patch is available to fix the issue.

Description

A flaw has been found in Trusted Domain Project OpenDMARC up to 1.4.2. Affected by this vulnerability is the function opendmarc_sp2_find_mailfrom_domain of the file libopendmarc/opendmarc_spf.c of the component SPF Macro Handler. This manipulation causes improper authentication. The attack is possible to be carried out remotely. The exploit has been published and may be used. Patch name: c48a74c758677fc5272a73eff15ffdbf8afda1a6. Applying a patch is the recommended action to fix this issue.

Impact

The flaw compromises the integrity of SPF checks, allowing attackers to bypass domain authentication and send spoofed emails. This threatens confidentiality by enabling phishing, integrity by allowing message tampering, and availability if spammers flood the system. Defenders must monitor for anomalous SPF failures and enforce stricter DMARC policies.

Remediation

Apply the official patch identified by commit c48a74c758677fc5272a73eff15ffdbf8afda1a6 to upgrade OpenDMARC to 1.4.3 or later. If patching is not immediately possible, disable the SPF Macro Handler or enforce DMARC reject policies to mitigate spoofing. Verify the installation with 'opendmarc -V' and test SPF validation after update.

Risk context

High severity (CVSS 7.3) and publicly available exploit make this issue urgent. Defenders should prioritize patching within the next 48 hours to mitigate potential spoofing attacks.

Affected products

  • OpenDMARC 1.4.2
  • Trusted Domain Project

Scores

Severity
high
CVSS v2
7.5
CVSS v3
7.3
CVSS v4
—
EPSS
—

OpenDMARC SPF Authentication Email HighSeverity Patch DMARC

← All CVEs

Related CVEs

high

CVE-2026-101280

OpenDMARC versions up to 1.4.2 contain a remote authentication bypass that allows attackers to spoof domain validation. The flaw resides in the opendmarc_policy_query_dmarc function of the Multi-Record Set Handler. This can compromise email authentication for affected mail servers.

View analysis

high

CVE-2026-101878

Bitwarden Server versions prior to 2026.5.0 incorrectly truncate the @ExternalId parameter in a stored procedure, allowing an attacker to impersonate another user and obtain a victim‑scoped access token. This flaw affects SQL Server deployments of the Bitwarden Server and can be exploited by users with SSO identifiers that begin with another member’s 50‑character ID. The vulnerability enables unauthorized access to sensitive vault data.

View analysis

high

CVE-2026-102243

A vulnerability was identified in MODSetter SurfSense up to 2.0.3. This issue affects some unknown processing of the file /api/search-source/connectors/mcp/test of the component MCP Connector Integration. Such manipulation leads to command injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

View analysis

high

CVE-2026-102365

mall4j through 4.0 fails to enforce authorization checks on GET endpoints in UserAddrController that retrieve customer address data. Authenticated attackers can call /user/addr/page and /user/addr/info endpoints to harvest all customer addresses including names, phone numbers, and postal information.

View analysis