In the Sagredo project, a fork of the qmail mail server has identified a vulnerability (CVE-2026-41113) that allows remote execution of arbitrary commands on the server with qmailr user privileges. This vulnerability arises from the lack of escaping special characters in the hostname returned by the DNS server when determining the MX gateway, combined with passing the received name to the popen command without proper separation and filtering of arguments during shell invocation. The vulnerability has been fixed in the release 2026.04.07. An exploitation toolkit for this vulnerability has been published in the public domain.
In October 2024, the Sagredo project made a change to the qmail-remote utility, adding the 'notlshosts_auto' function. This function remembers hosts with incorrect TLS protocol implementations that fail to establish a TLS connection, preventing infinite loops of failed mail sending to such hosts.
The issue is that the hostname was saved by executing the shell command using the popen() function with the argument '/bin/touch %s/control/notlshosts/'%s'', into which the MX host name returned by the DNS server was substituted. An attacker could run their own DNS server, returning an MX record like 'x'`id> /tmp/pwned`'y.evil.com', and execute the substituted code, creating conditions for invoking the save function for the failed mail host name. server.
Source: opennet.ru
