mailcow's Title Surface Is Not a Tenant Boundary Map

mailcow hosts multiple domains and routes their mail through shared services. A useful exposure review therefore has to connect external product matches to tenant ownership and domain-administrator roles.

On 2026-11-13 between 07:40 and 07:43 Asia/Shanghai, ZoomEye count-only queries used sub_type=all, page 1 and page size 1.

The enormous difference is a warning about interpreting a keyword count as a deployment count. A title can contain the name in documentation, customer content, a footer, a monitoring page or a legitimate mail interface.

The shared-service issue

CVE-2026-125757 affects mailcow: dockerized before 2026-11. A domain administrator can store a malicious domain-wide footer. The footer is rendered later by rspamd's jinja/lupa engine when a user sends authenticated outbound mail.

Template syntax can reach Lua os.execute. Code then runs in the rspamd container shared by all tenants. The attacker can read, modify or inject mail across domains, harvest in-transit credentials and disable filtering.

The issue is a cross-tenant boundary failure. It cannot be assessed by counting mailcow titles alone.

Narrow the candidate list

Use the title results only as an outreach set. Confirm which assets are live mailcow installations controlled by the organization. Include hosts that are not externally visible but process mail for multiple tenants.

Record the mailcow release, domain list, domain-administrator accounts and rspamd container placement. Review whether tenants share the same scanner and Redis services.

Inspect footer history, outbound message logs and container restarts. Look for unexpected commands, restarts and rspamd child processes. Preserve mail evidence in a way that respects privacy and legal requirements.

Remediation priority

Upgrade to 2026-11 or later. Remove unknown footers, rotate tenant and scanner credentials and review domain-administrator assignments.

Operators should start with deployments where unrelated tenants share a rspamd container. A single-domain deployment still needs the fix, but the cross-tenant blast radius is different.

Verification

After upgrading, store a benign footer with template syntax in a test domain and confirm that it is not executed. Verify that the footer is treated as data and that the rspamd worker does not spawn an unexpected command.

Keep the exact search counts and query scope. They support discovery, while configuration and message evidence support the security conclusion.

References

• GitHub Security Advisory GHSA-jgr3-fv33-x43c
• ZoomEye AI