Dovecot CVE-2026-40018: MySQL Escaping Bug Opens the Door to SQL Injection

Dovecot’s security page quietly listed a new high-severity advisory on August 28, 2026. The major Linux distributions took about six weeks to ship patched packages, and Red Hat’s advisory for RHEL 10 landed on October 8, 2026. If you run Dovecot against a MySQL or MariaDB backend and haven’t updated recently, read on.

What the Bug Is

CVE-2026-40018 is an SQL injection flaw (CWE-89) in Dovecot’s MySQL driver. The escaping function that sanitizes SQL query parameters falls back to a charset-unaware escape call when the SQL connection drops and reconnects under specific multi-byte character sequences. An attacker who can supply crafted input at the right moment — say, through a malformed username or password string — can break out of the expected SQL context and either read sensitive data or modify it.

This is not a trivially exploitable “paste the payload and watch it burn” vulnerability. The CVSS 3.1 vector rates it at 7.4 (High) with Attack Complexity set to High (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N). No privileges are required, and it’s network-reachable, which keeps it in the “patch promptly” category even if it won’t be drive-by exploited in the next 24 hours.

The flaw affects Dovecot deployments that use MySQL or MariaDB as their user-authentication or mail-storage backend. If you run Dovecot purely against flat files or LDAP with no SQL backend, you’re not exposed.

Affected Versions

• OX Dovecot Community Edition: versions 2.3.0 through 2.4.4 — fix is in 2.4.5
• OX Dovecot Pro: versions 2.3.0 through 3.1.5 — fix is in 3.1.6

Most distributions ship the 2.3.x branch as their stable package, so the practical fix is whatever your distro has backported the patch into.

Patch Status by Distribution

For Debian and Ubuntu, check your distro’s security tracker. The upstream fix predates the Red Hat advisory by six weeks, so if your distro’s Dovecot package hasn’t been updated since late August, it may still be vulnerable.

Exploitation Outlook

As of this writing, there are no public proof-of-concept exploits. The EPSS score is 0.27% (low probability of exploitation in the next 30 days), and the flaw is not in CISA’s Known Exploited Vulnerabilities catalog. The High attack-complexity rating reflects a real requirement: the attacker needs the SQL connection to drop and reconnect mid-request in a way that lets the malformed escape slip through. That’s not nothing, but it’s also not a condition that only exists in theory on a busy mail server.

The combination of no exploits, high complexity, and a vendor advisory that’s nearly two months old suggests this is not an active incident — but it is the kind of thing that gets weaponized once someone publishes a working trigger, so there’s no good reason to wait.

What This Means for kalfaoglu.net Customers

Mail servers at kalfaoglu.net authenticate user accounts through a SQL-backed Dovecot installation. If CVE-2026-40018 were exploited successfully — which requires a network attacker, a degraded SQL connection, and a crafted payload — it could theoretically expose account credential hashes stored in the mail database or allow modification of authentication records.

We’re monitoring our Dovecot version and will apply the patched packages during the next maintenance window. No evidence of exploitation exists, and customers don’t need to change their passwords at this time. If that assessment changes, we’ll say so directly.

What You Should Do

If you run your own hosting stack with Dovecot and MySQL/MariaDB:

1. Check your Dovecot version: dovecot --version
2. Check whether the fix is in your installed package: rpm -q dovecot or dpkg -l dovecot-core
3. If not patched, update: dnf update dovecot (RHEL-family) or apt upgrade dovecot-core (Debian-family)
4. Restrict SQL access: Dovecot’s database user should have only the permissions it actually needs — read-only on the user table if you’re not storing per-user quota data through SQL.
5. Monitor database logs for unexpected queries in the dovecot context.

The upstream Dovecot security page is the authoritative source. If you run OX Dovecot Pro, contact your vendor for the 3.1.6 build.