Bug 2542898 (CVE-2026-101280)

Summary: CVE-2026-101280 opendmarc: opendmarc: Authentication bypass via improper multi-record set handling
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedKeywords: Security
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in OpenDMARC. The opendmarc_policy_query_dmarc function improperly processes multi-record Domain-based Message Authentication, Reporting, and Conformance (DMARC) policy responses, allowing a remote attacker to bypass authentication checks. An attacker can exploit this issue to spoof sender identities and deliver unauthorized email messages that circumvent domain policy enforcement.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2542954, 2542956    
Bug Blocks:    

Description OSIDB Bzimport 2026-09-29 01:01:59 UTC 
A vulnerability was detected in Trusted Domain Project OpenDMARC up to 1.4.2. Affected is the function opendmarc_policy_query_dmarc of the component Multi-Record Set Handler. The manipulation results in authentication bypass by spoofing. The attack can be executed remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.