Skip to content
Two CVEs Disclosed for Trusted Domain Project OpenDMARC

Two CVEs Disclosed for Trusted Domain Project OpenDMARC

First seen 28 Sep 2026, 17:08 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •September 28, 2026 at 18:20 UTC
  • •Two critical vulnerabilities identified in OpenDMARC, CVE-2026-101015 and CVE-2026-100891.
  • •Both vulnerabilities allow remote exploitation without prior authentication.
  • •Organizations using affected DMARC services should prioritize assessment and monitoring.

On 2026-09-28, two vulnerabilities were disclosed in Trusted Domain Project OpenDMARC version 1.4.2. CVE-2026-101015 involves improper validation in the policy.c file, allowing remote manipulation that could weaken email authentication. CVE-2026-100891 relates to an encoding error in the opendmarc_policy_query_dmarc function, also enabling remote attacks. Both vulnerabilities were publicly disclosed with no response from the vendor. The risk is elevated for organizations using DMARC services on public-facing mail infrastructure. Exploitation status for both CVEs remains unconfirmed, and no remediation versions are available. Organizations are advised to monitor logs for unusual activity and validate their configurations against expected outcomes.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-09-28
CVE-2026-101015 published
A flaw in OpenDMARC's policy.c file allows improper validation of input, enabling remote attacks.
Redpacketsecurity
2026-09-28
CVE-2026-100891 published
A vulnerability in OpenDMARC's IDN handling leads to encoding errors, allowing remote exploitation.
Redpacketsecurity

More articles in this cluster (3)

Following this threat?

Track CVE-2026-100891 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (4)

1 / 2