CVE-2026-41113: RCE in sagredo fork of qmail

[Alan Coopersmith <alan.coopersmith () oracle com>]

https://blog.calif.io/p/we-asked-claude-to-audit-sagredos and
https://github.com/califio/publications/tree/main/MADBugs/qmail
disclose CVE-2026-41113 in the version of qmail from
https://github.com/sagredo-dev/qmail .

> qmail-remote RCE via DNS MX Hostname Shell Injection (CVE-2026-41113)
>
> Remote code execution in sagredo-dev/qmail through shell injection in
> tls_quit(). An attacker who controls DNS for any domain the target server
> sends mail to can execute arbitrary commands as the qmailr user.
>
> Affected        sagredo-dev/qmail v2024.10.26 through v2026.04.02
> Fixed in        v2026.04.07 (commit 749f607)
> Requirement     control/notlshosts_auto enabled
> CVSS 3.1        8.2 High (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
> CVE             CVE-2026-41113


> Our system zeroed in on a feature called notlshosts_auto that was added in
> October 2024. The idea behind it is reasonable: when qmail tries to deliver
> mail and the remote server's TLS is broken, you don't want to retry TLS
> forever, so this feature automatically remembers the bad host by creating a
> marker file named after it, and future deliveries skip TLS for that host.
> The implementation lives in qmail-remote.c, inside the TLS error handler
> tls_quit():
>
>     sprintf(acfcommand, "/bin/touch %s/control/notlshosts/'%s'",
>             info->pw_dir, partner_fqdn);
>     fp = popen(acfcommand, "r");
>
> It builds a shell command containing the remote hostname and runs it with
> popen(). The author wrapped the hostname in single quotes, presumably
> thinking that neutralizes shell metacharacters, but that protection fails
> the moment the hostname contains a single quote of its own.
>
> The obvious objection is that hostnames can't contain single quotes, and
> that's true of host names in the RFC 952 sense, but it is not true of DNS
> labels. On the wire, a DNS label is just a length byte followed by up to
> 63 arbitrary bytes; RFC 1035 lets you put nearly anything in there, and
> most recursive resolvers will happily pass it through. When qmail calls
> glibc's dn_expand() to decode an MX record, some special characters get
> escaped, but ', `, |, &, <, and > come through untouched. The net result
> is that partner_fqdn, the string being pasted into a shell command, is
> attacker-controlled via DNS.

Further details about how the bug was found are provided in the blog,
while the github repo provides PoC setup & exploit code.

--
        -Alan Coopersmith-                 alan.coopersmith () oracle com
         Oracle Solaris Engineering - https://blogs.oracle.com/solaris