CVE-2021-44026: Roundcube Webmail SQL injection, exploited by state-linked actors
The short version: Roundcube Webmail has a SQL injection flaw (CVE-2021-44026) in its search handling that lets an authenticated user inject SQL through session variables and reach the underlying mail database. It's in CISA's KEV catalog and has featured in espionage against webmail servers. The fix is old and simple — the risk is running an unpatched instance on the internet. Steady hands: patch and confirm.
At a glance
| Fact | Detail |
|---|---|
| Our severity take | High — in practice (see below) |
| CVSS v3.1 (NVD) | 9.8 — Critical · AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| EPSS | 42.75% · 98.57th percentile (2026-07-17) |
| In CISA KEV? | Yes — remediation was due 2023-07-13 |
| Known exploited? | Yes — associated with state-linked webmail espionage |
| Vulnerability type | CWE-89 SQL injection → mail-database access |
| Requires authenticated session? | Yes — the flaw is in the authenticated search feature |
| Affected | Roundcube Webmail before 1.3.17 and 1.4.x before 1.4.12 |
| Fixed in | 1.3.17 · 1.4.12 |
What you need to know
The injection is reachable through the search / search_params handling, where user-influenced values are stored in session variables without adequate type checking. An authenticated user can craft input that becomes part of a SQL statement — the classic path to reading data the application never meant to expose.
- It's authenticated, but that's the point of webmail. The attacker needs a valid mailbox session; in practice that's obtained through phishing, spraying, or chaining an XSS bug to ride an existing session.
- The target is your mail store. SQL injection into the mail database means access to message metadata and contents beyond the attacker's own account.
- NVD scores it unauthenticated (PR:N); the practical prerequisite is a session. We call that out so the 9.8 doesn't get read as "no login required."
How serious we see it
High — serious, with an honest caveat.
NVD's 9.8 reflects a network-reachable injection with high impact. The real-world tempering is the authentication step: this isn't a drive-by against an anonymous visitor, it's a logged-in-user primitive. But it's KEV-listed for a reason — it has been used in targeted campaigns against webmail — and the impact (database access on a mail server) is exactly what an espionage actor wants. The reassuring part: the affected versions are years old and the fix is a free upgrade.
Recommendations
Straight from Roundcube's advisory and CISA:
- Patch now. Upgrade to 1.4.12 or 1.3.17 (or later) — both are well past end-of-life lines now, so plan for a current release.
- Enforce MFA on webmail. It raises the cost of getting the authenticated session this flaw needs.
- Restrict exposure. Keep the Roundcube host reachable only where it must be.
- Hunt if you ran an affected build exposed. Review for anomalous queries and unexpected data access.
- Confirm your exposure first. Verify whether an internet-facing Roundcube instance exists and which version.
How BreachRisk sees it
BreachRisk discovers internet-facing Roundcube from little more than your domain, fingerprints the version from the app's own resources, and flags exposure tied to KEV-listed vulnerabilities like this one — surfaced at the top because it's actively exploited. We detect and flag the affected version; we don't run the injection. The value is the outside-in inventory: an aging, exposed Roundcube build is already mapped before it becomes someone's foothold.