CVE-2026-33586

UNKNOWN 0.0

Authenticated SMTP Sender Address Forgery

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

Authenticated users are able to manipulate both the SMTP envelope “Envelope-from” and “From” fields when sending emails through OVH mail servers. Due to OVH's default SPF configuration, which commonly includes include:mx.ovh.com, any authenticated user with a valid OVH email account can send messages that appear to originate from any OVH-hosted domains using the default SPF record. Since the SPF policy explicitly authorizes OVH mail servers (mx.ovh.com) to send mail on behalf of these domains, forged messages successfully pass SPF validation despite not being authorized by the impersonated domain owner.

CWE	CWE-1188 CWE-346 CWE-290
Vendor	ovhcloud
Product	ovhcloud
Published	Oct 7, 2026

Stay Ahead of the Next One

Get instant alerts for ovhcloud ovhcloud

Be the first to know when new unknown vulnerabilities affecting ovhcloud ovhcloud are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

OVHcloud / OVHcloud

0 < 2026-07-20

References

NVD ↗ CVE.org ↗ EPSS Data ↗

docs.ovhcloud.com: https://docs.ovhcloud.com/en/guides/web-cloud/email-and-collaborative-solutions/troubleshooting/email-rejected-cross-domain-spoofing

Credits

Abdullah HAMED of ENGIE IT Offensive Cybersecurity Team