CVE-2026-121424
개요
A flaw was found in nodemailer. A remote attacker can cause email redirection and information disclosure by supplying a specially crafted email address containing nested comments. The internal address parser prematurely ends comment processing at the first closing parenthesis, treating the remaining comment text as the destination address. This enables an attacker to bypass recipient allowlists and route sensitive communications to unauthorized destinations or spoof sender identities.
내용
This vulnerability is rated as having a Moderate impact for Red Hat products because exploitation requires an application to accept and parse untrusted, user-supplied email strings without independent domain validation. In typical Red Hat environments, such as Red Hat Developer Hub and Grafana, notification endpoints and recipient lists are configured by privileged administrators rather than arbitrary external actors. This operational model significantly restricts the attack surface and reduces the risk of unauthorized message redirection or sender spoofing.
CVSS (Common Vulnerability Scoring System) 점수 세부 사항
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
다음의 CVSS 지표 및 점수는 예비 정보로 검토 대상입니다.
CVSS v3 점수 분석
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| 기본 점수 | 6.5 | N/A | 6.5 |
| 공격 벡터 | Network | N/A | Network |
| 공격 복잡성 | High | N/A | High |
| 필요한 권한 | None | N/A | None |
| 사용자 상호 작용 | None | N/A | None |
| 범위 | Unchanged | N/A | Unchanged |
| 기밀성 | High | N/A | High |
| 무결성에 미치는 영향 | Low | N/A | Low |
| 가용성에 미치는 영향 | None | N/A | None |
벡터
Red Hat: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N
cve.org: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N
취약점 이해 (CWE)
Integrity
Technical Impact: Unexpected State
