CVE-2026-29138
Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.
NVD · uneditedSEPPmail Secure Email Gateway before version 15.0.3 allows attackers with a specially crafted email address to claim another user's PGP signature as their own.
Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.
dbcve analysis · high confidenceSEPPmail Secure Email Gateway versions prior to 15.0.3 contain an identity spoofing vulnerability in PGP signature validation. Attackers can craft a malicious email address that tricks the gateway into attributing another user's PGP signature to the attacker's messages, enabling impersonation of trusted senders.
Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.
Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.
NVD · CPE data< 15.0.3CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.
From the vector- Attack vector
- Network
- Complexity
- Low
- Privileges
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- None
- Integrity
- High
- Availability
- None
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.
dbcve checksWork through these to decide whether this CVE applies to you.
-
Determine SEPPmail Secure Email Gateway versionAccess the administration console or check system information files to identify the currently installed version. Look for version details in the product's about section, license information, or release notes.Affected if The installed version is below 15.0.3
-
Verify PGP signature validation is enabledCheck the SEPPmail configuration settings for PGP module status. Look for PGP-related settings in the security or email processing configuration panels.Affected if PGP signature validation is actively enabled in the gateway settings
-
Inspect PGP key associationsReview the configured PGP public keys and their associated email addresses. Check the keyring or trusted sender mappings within the SEPPmail administration interface.Affected if Multiple email addresses are mapped to the same PGP key, or unexpected sender key associations exist
-
Check email routing logs for signature claimsExamine mail logs or the PGP verification logs for recent messages. Look for instances where the claimed sender email differs from the email address bound to the PGP key used for verification.Affected if Log entries show mismatches between sender email addresses and the PGP keys validating those messages
-
Review sender whitelist or trusted sender configurationsInspect the trusted sender lists and PGP key assignments in the gateway. Verify that only intended email addresses are associated with each PGP key.Affected if Unexpected or unauthorized email addresses are listed as trusted senders for PGP-verified messages
You are affected if you are running SEPPmail Secure Email Gateway version prior to 15.0.3 with PGP signature validation enabled, and an attacker could exploit the mismatch between crafted sender addresses and legitimate PGP key bindings.
Generated from the published advisory. Verify against your own configuration.
Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.
dbcve · scoped15.0.3
Upgrade SEPPmail Secure Email Gateway to version 15.0.3 or later. Verify PGP key associations are correct after the upgrade and monitor for any suspicious signature claims.
15.0.3
- Download SEPPmail Secure Email Gateway version 15.0.3 or later from the official vendor download site (downloads.seppmail.com)
- Review the SEPPmail upgrade documentation for your current version
- Apply the upgrade following the vendor's documented upgrade procedure
- Verify the upgrade was successful by confirming the running version is 15.0.3 or later
Generated from the published advisory — verify against the referenced sources before acting.
- Consultation2.0 h
- Implementation3.0 h
- Testing4.0 h
- Review / QA2.0 h
An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $3,040.
Scan for this in your stack
Free · runs locallyCheck whether your project pulls in CVE-2026-29138 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.
References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.
Primary sourcesPractitioner notes
ContributedPeer-ranked notes from engineers who’ve handled CVE-2026-29138 in production — separate from our analysis above.
The advisory tells you what broke. It rarely tells you what actually worked. If you’ve dealt with this one, that detail is what the next engineer is searching for.
- The version that genuinely resolved it — not the one the vendor claimed
- A config change or rule that shut the vector down
- A gotcha in the upgrade path that cost you an afternoon
No notes yet
Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.
A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.
- Verified mitigations, workarounds, and config changes
- Version or environment caveats, and links to real fixes
- No weaponised exploit code, or anything meant to cause harm
- No spam, self-promotion, credentials, or personal data