CVE-2026-27851
High
Description
When safe filter is used with variable expansion, all following pipelines on the same string are incorrectly interpreted as safe too, enabling unsafe data to be unescaped. This can enable SQL / LDAP injection attacks when used in authentication. Avoid using safe filter until on fixed version. No publicly available exploits are known.
SeverityHigh
CVSS7.4
Exploit probability—
ProductDovecot
PublishedMay 12, 2026
First seenMay 12, 2026
Weakness typeCWE-235CWE-235
How to fix
Update
- dovecot dovecot2.4.4 or later
- open-xchange dovecot3.1.5 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| dovecot dovecot | v < 2.4.4 | 2.4.4 |
| open-xchange dovecot | v < 3.1.5 | 3.1.5 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.