CVE-2021-26911
core/imap/MCIMAPSession.cpp in Canary Mail before 3.22 has Missing SSL Certificate Validation for...
core/imap/MCIMAPSession.cpp in Canary Mail before 3.22 has Missing SSL Certificate Validation for IMAP in STARTTLS mode.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
core/imap/MCIMAPSession.cpp in Canary Mail before 3.22 has Missing SSL Certificate Validation for IMAP in STARTTLS mode.
- Record
CVE-2021-26911- CVSS 3.1
- 7.4 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N - CVSS 2.0
- 5.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:N - Weakness
- CWE-295
- Updated
- 2026-11-02
CVE List No score
core/imap/MCIMAPSession.cpp in Canary Mail before 3.22 has Missing SSL Certificate Validation for IMAP in STARTTLS mode.
- Record
CVE-2021-26911- Updated
- 2026-11-02
EUVDEUVD-2021-13695 No score
core/imap/MCIMAPSession.cpp in Canary Mail before 3.22 has Missing SSL Certificate Validation for IMAP in STARTTLS mode.
- Record
EUVD-2021-13695- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-hw2c-8pmg-px6w No score
core/imap/MCIMAPSession.cpp in Canary Mail before 3.22 has Missing SSL Certificate Validation for...
core/imap/MCIMAPSession.cpp in Canary Mail before 3.22 has Missing SSL Certificate Validation for IMAP in STARTTLS mode.
- Record
GHSA-hw2c-8pmg-px6w- Weakness
- CWE-295
- Updated
- 2026-11-02
OSV
core/imap/MCIMAPSession.cpp in Canary Mail before 3.22 has Missing SSL Certificate Validation for IMAP in STARTTLS mode.
- Record
CVE-2021-26911- CVSS 3.1
- 7.4 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-26911 is a high vulnerability (CVSS 7.4) in Canarymail Canary Mail, published February 17, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.09%, the 65th percentile. No source names a fixed version.
References
apps.apple.com/us/app/canary-mail/id1236045954
census-labs.com/news/category/advisories
openwall.com/lists/oss-security/2021/02/17/3
github.com/canarymail/mailcore2/commit/45acb4efbcaa57a20ac5127dc976538671fce018
nvd.nist.gov/vuln/detail/CVE-2021-26911