Bug 2571201 (CVE-2026-126068)

Summary: CVE-2026-126068 actionmailbox: Action Mailbox: Inbound email forgery via Mailgun webhook signature replay
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: akostadi, amasferr, dmayorov, ehelms, eshamard, jlledo, jpasqual, juwatts, jvasik, kaycoth, lblicha, mhulan, ogajduse, osousa, pantinor, rblanco, rchan, smallamp, tsedmik, zhunting
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in Action Mailbox. The Mailgun ingress controller fails to reject incoming webhook requests with timestamps set in the future and concatenates authentication parameters without a separator when verifying the Hash-based Message Authentication Code (HMAC) signature. A remote attacker who intercepts a single signed request can manipulate the parameters to reuse the signature indefinitely, enabling them to submit forged inbound emails that the application processes as genuine.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-11-10 20:53:24 UTC 
Action Mailbox routes incoming emails to controller-like mailboxes for processing in Rails. Prior to 8.1.4.1 and 8.0.5.2, the Action Mailbox Mailgun ingress authenticates a request with an HMAC of the timestamp and token parameters concatenated without a separator, and ActionMailbox::Ingresses::Mailgun::InboundEmailsController::Authenticator#recent? rejects only timestamps more than 2 minutes in the past. Because the signature does not fix the boundary between the two values, a captured signed request can be presented with a timestamp far in the future, which the ingress then accepts indefinitely. An attacker who obtains one signed Mailgun webhook request, but not the signing key, could submit arbitrary inbound email that Action Mailbox processes as genuine, possibly leading to forged messages attributed to the sender of the attacker's choosing. Applications that receive inbound email through the Action Mailbox Mailgun ingress are affected. This issue is fixed in versions 8.1.4.1 and 8.0.5.2.