CVE-2026-27851 is a high severity flaw (CVSS 7.4) in Dovecot's variable expansion. When the safe filter is used, later pipelines on the same string are wrongly treated as safe, which can allow SQL or LDAP injection in authentication. Fixes are Dovecot CE 2.4.4 and Pro 3.1.5. Until then, avoid the safe filter.
What's affected
OX Dovecot advisory OXDC-ADV-2026-0002 lists these versions:
- Dovecot CE: 2.4.3 is the last affected version listed, and 2.4.4 is the first fixed version
- Dovecot Pro: 3.1.4 is the last affected version listed, and 3.1.5 is the first fixed version
The advisory's product tree also names older releases such as CE 2.4.0 and Pro 2.3.0, 3.0.5 and 3.1.0. Read the advisory for the status of your branch. The component is lib-var-expand.
How to check if you're exposed
Check your Dovecot version and whether your configuration uses the safe filter.
dovecot --version
doveconf -n | grep -i safe
grep -rn "safe" /etc/dovecot/
The first command prints the version. The others look for the filter in the effective and on-disk configuration. A site that does not use the filter in a variable expansion is not exposed to this particular path, but should still upgrade.
Pay attention to authentication related settings such as SQL or LDAP lookups that build queries from variables.
What to do now
- Upgrade to Dovecot CE 2.4.4 or Pro 3.1.5 or later, using your vendor or distribution package.
- Until you can upgrade, avoid the safe filter, as the advisory advises.
- Review authentication settings that use SQL or LDAP lookups with variable expansion.
- If you use a distribution package, check your distributor's notice for how and when the fix lands.
- Keep monitoring authentication logs for failed or odd lookups.
Why it matters
The advisory title is lib-var-expand: safe filter leaks to all following pipelines. In practice, marking a value as safe once makes every later filter on that same string treated as safe, so unsafe data can be unescaped. In an authentication setup, that can enable SQL or LDAP injection. NVD classifies the flaw as CWE-235 (Improper Handling of Extra Parameters) and CWE-89 (SQL Injection).
The attack complexity is rated high, and the advisory states that no publicly available exploits are known. That is a good reason to schedule the update soon and not drop everything. Mail servers sit on the edge of most networks, so an authentication flaw there deserves a prompt fix.
Reading the advisory carefully
The OX Dovecot advisory gives a lot of useful structure. It names the component, lib-var-expand, lists first fixed versions for each product line and states the exploit status. It also lists a workaround that costs nothing: avoid the safe filter.
Check your authentication configuration for variable expansion in SQL and LDAP queries. A safe filter used on one value is easy to overlook when it sits in a long configuration file.
After upgrading, test authentication for a normal user and for a user name with unusual characters in a test environment.
Keep the advisory page in your notes with the date you applied the update. Mail server fixes are easy to lose track of across environments. If you run a cluster, upgrade one node first and watch authentication metrics before the rest.
Quick check
Is it exploited in the wild?
The advisory says no publicly available exploits are known, and the record does not mark it as a CISA Known Exploited Vulnerability.
What is the workaround?
Avoid the safe filter until you are on a fixed version, per the advisory.
Sources
Last reviewed: 19 October 2026.
