CVE-2026-104704: CWE-319: Cleartext Transmission of Sensitive Information in Progressive Robot Ltd hMailServer

CVE-2026-104704 describes a vulnerability in Progressive Robot Ltd's hMailServer versions 6.0.0 through 6.3.5 where the server does not enforce TLS for outbound SMTP delivery to mail exchangers whose DNSSEC-validated TLSA records do not contain a DANE-EE (usage 3) record, contrary to RFC 7672 section 2.2. The server only recognizes DANE-EE records and treats validated TLSA record sets containing DANE-TA (usage 2) or other unusable records as if no TLSA records were published. Consequently, delivery to such hosts falls back to opportunistic TLS, which can be downgraded by an attacker with an active network position to cleartext transmission by suppressing or breaking STARTTLS negotiation. This allows interception and modification of email messages in transit.

An attacker positioned on the network path between the hMailServer and the recipient's mail exchanger can cause outbound emails to be transmitted without encryption by interfering with the STARTTLS negotiation. This leads to cleartext transmission of sensitive information, enabling the attacker to read or modify email content. The vulnerability compromises confidentiality and integrity of outbound email messages but does not affect availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should consider alternative mitigations such as enforcing strict TLS policies manually or using external mail gateways that enforce proper DANE validation. Monitoring for updates from Progressive Robot Ltd is recommended.