Authenticated users are able to manipulate both the SMTP envelope “Envelope-from” and “From” fields when sending emails through OVH mail servers. (CVE-2026-33586)

The vulnerability (CVE-2026-33586) allows authenticated users of OVH mail servers to alter both the SMTP envelope 'Envelope-from' and 'From' fields when sending emails. OVH's default SPF records include 'include:mx.ovh.com', which authorizes OVH mail servers to send emails on behalf of hosted domains. Consequently, any authenticated user with a valid OVH email account can send emails that appear to come from any OVH-hosted domain, bypassing SPF validation and enabling domain spoofing.

This vulnerability enables authenticated OVH email users to spoof the sender address of any OVH-hosted domain, potentially facilitating phishing or impersonation attacks. Because the forged emails pass SPF validation, recipients relying on SPF for sender authentication may be deceived. There is no indication of privilege escalation or direct compromise of OVH infrastructure. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, OVH or affected domain owners should consider adjusting SPF records or implementing additional email authentication mechanisms such as DKIM and DMARC policies to detect or prevent spoofed emails. Monitoring and user awareness may help mitigate potential phishing risks.