CVE-2026-33586
Gravedad CVSS v4.0:
MEDIA
Tipo:
No Disponible / Otro tipo
Fecha de publicación:
07/10/2026
Última modificación:
08/10/2026
Descripción
*** Pendiente de traducción *** Authenticated users are able to manipulate both the SMTP<br />
envelope “Envelope-from” and “From” fields when sending<br />
emails through OVH mail servers.<br />
<br />
<br />
<br />
Due to OVH&#39;s default SPF configuration, which<br />
commonly includes include:mx.ovh.com, any authenticated user with a<br />
valid OVH email account can send messages that appear to originate from any<br />
OVH-hosted domains using the default SPF record. Since the SPF policy<br />
explicitly authorizes OVH mail servers (mx.ovh.com) to send mail on behalf of<br />
these domains, forged messages successfully pass SPF validation despite<br />
not being authorized by the impersonated domain owner.