Progressive Robot hMailServer: Local certificate interception vulnerability (CVE-2026-126609)

CVE-2026-126609 affects Progressive Robot hMailServer versions 6.2.25 through 6.3.7 on Windows when configured to use a PostgreSQL database or specific Oracle MySQL client libraries. Due to the way the application processes SSL root certificate filenames using the system ANSI code page, a discrepancy occurs when passing these paths to libpq or OpenSSL. An attacker with local access to create files in specific system directories (e.g., ProgramData or system root) can manipulate this process to force the application to read an attacker-controlled CA file, enabling interception and modification of traffic between the application and its database, including credential theft. This issue does not affect the default configuration, as no root certificate is specified by default.

Impact

Successful exploitation allows a local attacker to perform a man-in-the-middle attack on the database connection, resulting in the ability to read and modify sensitive data in transit, including the database password.

Recommendation

Inventory all hMailServer instances to identify versions 6.2.25 through 6.3.7. Verify if the database connection configuration utilizes sslmode "require", "verify-ca", or "verify-full" and has a root certificate file defined via PostgreSQLSslRootCert or TlsCaFile. Until a patch is available, ensure that file permissions on the configured certificate directory and the system root are restricted to prevent unauthorized file creation by low-privileged users.