High severity7.4NVD Advisory· Published Mar 27, 2026· Updated Apr 29, 2026

CVE-2026-27856

Description

Doveadm credentials are verified using direct comparison which is susceptible to timing oracle attack. An attacker can use this to determine the configured credentials. Figuring out the credential will lead into full access to the affected component. Limit access to the doveadm http service port, install fixed version. No publicly available exploits are known.

Affected products

Dovecot (software)/Dovecot
cpe:2.3:a:dovecot:dovecot:*:*:*:*:*:*:*:*
Range: <2.4.3
Open-Xchange/Dovecot2 versions
cpe:2.3:a:open-xchange:dovecot:*:*:*:*:pro:*:*:*+ 1 more
- cpe:2.3:a:open-xchange:dovecot:*:*:*:*:pro:*:*:*range: <2.3.22.1
- (no CPE)
osv-coords4 versions
pkg:rpm/opensuse/dovecot24&distro=openSUSE%20Leap%2016.0 pkg:rpm/opensuse/dovecot24&distro=openSUSE%20Tumbleweed pkg:rpm/suse/dovecot24&distro=SUSE%20Linux%20Enterprise%20Server%2016.0 pkg:rpm/suse/dovecot24&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20applications%2016.0
< 2.4.3-160000.1.1+ 3 more
- (no CPE)range: < 2.4.3-160000.1.1
- (no CPE)range: < 2.4.3-1.1
- (no CPE)range: < 2.4.3-160000.1.1
- (no CPE)range: < 2.4.3-160000.1.1

Patches

Vulnerability mechanics

References

documentation.open-xchange.com/dovecot/security/advisories/csaf/2026/oxdc-adv-2026-0001.jsonnvdVendor Advisory

News mentions

No linked articles in our index yet.

cvss	0.481
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000