Starstruk Logo MarkStarstruk

2026-07a

mailcow/mailcow-dockerized2026-07aJul 30, 2026by FreddleSpl0it

AI Summary

Addresses multiple security issues including Rspamd and nginx CVE fixes. This release introduces default mailbox templates with EAS and Dav access, along with various UI and API fixes.

Key Highlights

  • Rspamd updated to 4.1.4
  • Fix for nginx CVE-2026-42533
  • Fix subject display in quarantine overview
  • IPv6 binding fix
  • Default mailbox template with EAS and Dav access

Breaking Changes

  • ACME: Skip mta-sts certificate request when MTA-STS is not active

New Features

  • Default mailbox template with EAS and Dav access

Full Release Notes

## What's Changed

### Important
This update addresses several security-related issues in mailcow. We strongly recommend updating your mailcow instance as soon as possible.

### Updates and Security
* [Rspamd] update to 4.1.4 by @FreddleSpl0it in https://github.com/mailcow/mailcow-dockerized/pull/7386
* Fix nginx CVE-2026-42533 by @SYNLINQ in https://github.com/mailcow/mailcow-dockerized/pull/7358
* Update actions/stale action to v11 by @renovate[bot] in https://github.com/mailcow/mailcow-dockerized/pull/7375
* Hardening mailcow by @FreddleSpl0it in https://github.com/mailcow/mailcow-dockerized/pull/7387

### Fixes
* fix: restore subject display in quarantine overview by @oidipos in https://github.com/mailcow/mailcow-dockerized/pull/7367
* [Nginx] only bind IPv6 default_server when ENABLE_IPV6 is set by @smpaz7467 in https://github.com/mailcow/mailcow-dockerized/pull/7343
* [Web] fix add/time_limited_alias silently discarding requests and validity by @smpaz7467 in https://github.com/mailcow/mailcow-dockerized/pull/7345
* [Web] return sender_acl in get/mailbox API by @smpaz7467 in https://github.com/mailcow/mailcow-dockerized/pull/7348
* fix: cors allowed origins settings validation by @fallmo in https://github.com/mailcow/mailcow-dockerized/pull/7333
* [Web] harden CORS origin matching and add Vary: Origin by @FreddleSpl0it in https://github.com/mailcow/mailcow-dockerized/pull/7385
* [Web] Move mailcow update check to server side by @FreddleSpl0it in https://github.com/mailcow/mailcow-dockerized/pull/7388
* [Web] Create default mailbox template with eas and dav access by @FreddleSpl0it in https://github.com/mailcow/mailcow-dockerized/pull/7389
* [ACME] Skip mta-sts certificate request when MTA-STS is not active for a domain by @FreddleSpl0it in https://github.com/mailcow/mailcow-dockerized/pull/7390

## New Contributors
* @oidipos made their first contribution in https://github.com/mailcow/mailcow-dockerized/pull/7367
* @smpaz7467 made their first contribution in https://github.com/mailcow/mailcow-dockerized/pull/7343
* @fallmo made their first contribution in https://github.com/mailcow/mailcow-dockerized/pull/7333

**Full Changelog**: https://github.com/mailcow/mailcow-dockerized/compare/2026-07...2026-07a