Progressive Robot hMailServer: Improper certificate validation in MariaDB/MySQL connections (CVE-2026-126611)
A vulnerability in Progressive Robot hMailServer 6.3.4 through 6.3.7 allows a local attacker to perform a man-in-the-middle attack on database connections when configured with TlsMode=verify-full and no TlsCaFile.
CVE search metadata
CVE search record: CVE-2026-126611. Severity: high. CVSS: 7.0. KEV: no. Product: hMailServer (6.3.4 through 6.3.7). Brief: Progressive Robot hMailServer: Improper certificate validation in MariaDB/MySQL connections (CVE-2026-126611). Brief link: https://feed.craftedsignal.io/briefs/2026-11-cve-2026-126611-hmailserver/
Triage facts
Revision 1- Applicability
- hMailServer (6.3.4 through 6.3.7)
- Evidence
- Unknown
- Severity
- High
- Sources
- 1 public source
- Freshness
- Revision 1Nov 11, 14:03 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
Progressive Robot hMailServer 6.3.4 through 6.3.7, when using a MySQL or MariaDB database with TlsMode=verify-full and no TlsCaFile, does not verify the database server's certificate's issuer or name for connections treated as local by MariaDB Connector/C. This allows a local attacker to impersonate the database server, receive the database sign-in (including the password), and read or modify traffic between hMailServer and the database. This behavior is linked to MariaDB Connector/C versions 3.4.1 and later failing to validate certificates on local connections in the absence of a CA file.