CVE-2026-126610Progressive Robot Ltd hMailServer improper certificate validation
CVE-2026-126610 is a improper certificate validation in Progressive Robot Ltd hMailServer, rated high (7.4 on CVSS 3.1).
Why this priority: High severity, with no exploitation signal yet.
Published · Updated · NVD status: Received
What it is
TLS certificates are not checked properly, so an attacker on the path can pose as the server.
How it is reached
An attacker can exploit it over the network, without an account, and nobody has to click anything. Success also depends on conditions the attacker does not fully control.
What an attacker gains
A successful attack can read the data it protects and change data or behaviour. In practice, this kind of flaw lets an attacker read or tamper with traffic, or pass a forged message as genuine.
Is it being exploited?
There is no public report of exploitation yet.
What to do
- No fixed version is listed yet. Find every place Progressive Robot Ltd hMailServer runs, watch the references for a fix, and plan a replacement if it is no longer supported.
- While there is no fix, keep it off the internet or behind a VPN, allowlist or authenticating proxy.
Description from NVD
Progressive Robot hMailServer 6.3.4 through 6.3.7, with a MySQL or MariaDB database and TlsMode=verify-full, does not hand the database client the CA file that TlsCaFile names when the file's name contains a character outside ASCII on Linux, or above U+00FF on Windows, which allows an attacker who can intercept the connection to the database server to read and modify the traffic between hMailServer and its database, by presenting, with MariaDB Connector/C 3.4.2 to 3.4.10 as the client, a certificate from any authority, its own included, for any name, and otherwise a certificate for the database server's name issued by any certificate authority in the system's trust store. The server converted the name for the client with the C runtime's conversion in the C locale, which gives an empty string for such a name, and then set no CA file at all, without an error, while certificate verification stayed on, so the client - MariaDB Connector/C, bundled on Windows and the distribution's on Linux - verified the certificate of a database server over the network against the system's trust store instead of the configured CA; Connector/C 3.4.2 to 3.4.10 (bundled on Windows in 6.3.4 to 6.3.6) went further and, with no CA file, took a certificate within its dates whose issuer it could not find, for any name, with neither its chain nor its name checked and no password proof, when the server offered first a sign-in method that hashes the password, which an attacker in the middle chooses (MariaDB's CONC-853, fixed in Connector/C 3.4.11), and Connector/C 3.4 accepted from a MariaDB 11.4 or later server a certificate the store did not vouch for when that server proved it held the account's password; on a connection it treats as local (127.0.0.1, ::1, a Unix socket, a named pipe, and localhost on Windows), Connector/C 3.4.1 and later checked neither the certificate's issuer nor its name, so that a local attacker able to stand in for the database server could present any certificate within its dates of its own making. The settings line of hmailserver --check-database still named the configured file, and the application log said the certificate had been checked. With MariaDB Connector/C 3.4.1 to 3.4.9 as the client - bundled on Windows in 6.3.4 to 6.3.6, and the client of Linux distributions that have not patched it - the missing CA file also met the precondition of CVE-2026-107819, so that a certificate issued for any other name by a trusted authority was enough to obtain the database password. On Linux the file was found only when the server ran on glibc under a locale whose character set holds the name's characters (a UTF-8 locale, or a legacy 8-bit one the system has, in whose bytes the file is then named); with no locale, LC_ALL=C or a locale the system lacks, and on Alpine (musl), the connection failed instead. The configuration is not the default: TlsMode defaults to prefer, which checks no certificate.
What this means for your architecture.
A CVE names a product. Whether it matters depends on where that product sits in your systems: what reaches it, which trust boundary it guards and what it can reach once compromised. Veriom maps your components, their relationships and your trust boundaries from your code, cloud and delivery evidence, so you can see where a component like this sits. The radar itself does not look at your systems.
Components it touches
- TLS termination and service-to-service channels. The flaw sits on the network path between clients and services.
- Signature checks. The flaw sits on the network path between clients and services.
Trust boundaries in play
- Internet-facing entry points. No account is needed. Any instance reachable from outside your perimeter, through a load balancer, gateway, VPN or exposed admin port, is in scope.
- On the network path between clients and services. An attacker who crosses it can read or tamper with traffic, or pass a forged message as genuine.
Questions to answer about your own systems
- Where does Progressive Robot Ltd hMailServer run in your systems, and at which version?
- Which of those instances can be reached from the internet or partner networks?
- What can it reach once compromised: which data stores, secrets and services?
Sources
- CVE records and CVSS scores from the NVD CVE API. This product uses the NVD API but is not endorsed or certified by the NVD.
- Exploitation status from CISA’s Known Exploited Vulnerabilities catalog.
- Exploit likelihood from FIRST’s Exploit Prediction Scoring System (EPSS), refreshed daily.
- Explanations are written by Veriom from fixed templates over each record’s data, not by a person reviewing each CVE. Descriptions are quoted from the records as published.