CVE-2026-2376
CWE-601Published: March 12, 2026· Updated: Mar 12, 2026
Official Description
A flaw was found in mirror-registry where an authenticated user can trick the system into accessing unintended internal or restricted systems by providing malicious web addresses.
When the application processes these addresses, it automatically follows redirects without verifying the final destination, allowing attackers to route requests to systems they should not have access to.
Technical Analysis
CVE-2026-2376 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.
Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.
The vulnerability has a "Changed" scope, meaning successful exploitation can impact components beyond the vulnerable component itself — such as the host operating system or adjacent services.
CVSS v3.1 Vector Breakdown
Exploit & PoC Resources
News & Research Mentioning CVE-2026-2376
Underground Telegram channels shared SmarterMail exploit PoCs and stolen admin credentials within days of disclosure. Flare explains how monitoring these communities reveals rapid weaponization of CVE-2026-24423 and CVE-2026-23760 tied to ransomware activity. [...] [xlite_meta score:67 src:BleepingComputer xlite_fp:a06b6c12843d7762f64d13f5dfaf38050abc1a46aada007e4a8c8d1563aff19e]
All References (3)
Quick Facts
Related CVEs (CWE-601)
Recommended Actions
- →Apply vendor patches immediately
- →Monitor CVE-2026-2376 in threat intel feeds
- →Review IDS/IPS signatures for exploitation attempts