Niedrig 3.7Linux-Server
CVE-2026-126068
actionmailbox: Action Mailbox: Inbound email forgery via Mailgun webhook signature replay
actionmailbox
### Impact The Action Mailbox Mailgun ingress authenticates a request with an HMAC of the `timestamp` and `token` parameters concatenated without a separator, and `ActionMailbox::Ingresses::Mailgun::InboundEmailsController::Authenticator#recent?` rejects only timestamps more than 2 minutes in the past. Because the signature does not fix the boundary between the two values, a captured signed request can be presented with a timestamp far in the future, which the ingress then…
10. Nov 2026
Original bei Red Hat öffnen