CVE-2026-126068
Description
A flaw was found in Action Mailbox. The Mailgun ingress controller fails to reject incoming webhook requests with timestamps set in the future and concatenates authentication parameters without a separator when verifying the Hash-based Message Authentication Code (HMAC) signature. A remote attacker who intercepts a single signed request can manipulate the parameters to reuse the signature indefinitely, enabling them to submit forged inbound emails that the application processes as genuine.
Statement
This vulnerability is rated as Low severity because successful exploitation requires an attacker to first intercept a valid webhook transaction, and the impact is confined to injecting forged inbound messages rather than compromising host confidentiality or service availability. Action Mailbox is not enabled or configured by default across Red Hat platforms, and exploitation is strictly limited to applications specifically deployed to ingest incoming mail through third-party Mailgun webhooks. Consequently, standard deployments are unaffected unless this optional integration is explicitly incorporated into custom application workflows.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 3.7 | N/A | 3.7 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | High | N/A | High |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | None |
| Integrity Impact | Low | N/A | Low |
| Availability Impact | None | N/A | None |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
cve.org: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Understanding the Weakness (CWE)
Access Control
Technical Impact: Gain Privileges or Assume Identity
Messages sent with a capture-relay attack allow access to resources which are not otherwise accessible without proper authentication.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
