CVE-2026-7666: Potential unencrypted email transmission via STARTTLS in the SMTP backend
An issue was discovered in Django 6.0 before 6.0.6 and 5.2 before 5.2.15. django.core.mail.backends.smtp.EmailBackend in Django fails to prevent reuse of a partially-initialized connection after a failed STARTTLS handshake when failsilently=True, which allows on-path network attackers to read email content via cleartext interception. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Kasper Dupont for reporting this issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Djangoto a version that resolves this vulnerability.Fixed in 6.0.6 - Upgrade
Upgrade
Djangoto a version that resolves this vulnerability.Fixed in 5.2.15 - Configuration
Do not use fail_silently=True with the SMTP EmailBackend. Set fail_silently=False or handle SMTP exceptions so a failed STARTTLS does not allow reuse of a partially-initialized connection.
django.core.mail.backends.smtp.EmailBackend fail_silently = false - Compensating control
Prevent on-path interception of SMTP traffic: restrict outbound SMTP to trusted mail relays via firewall/ACLs, require encrypted transport to mail relays (e.g., enforce STARTTLS/SMTPS), or route SMTP traffic over secure networks (VPN) until code is patched.
- Operational
If you run earlier/unsupported Django series (e.g., 5.0.x, 4.1.x, 3.2.x), assess exposure for this issue, review mail-sending logs for potential cleartext transmission, and plan migration to a supported fixed release or follow vendor guidance.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-7666?
The severity of CVE-2026-7666 is rated as low with a score of 3.1.
How do I fix CVE-2026-7666?
To fix CVE-2026-7666, upgrade Django to version 6.0.6 or later, or 5.2.15 or later.
What impact does CVE-2026-7666 have on email security?
CVE-2026-7666 allows on-path attackers to potentially read unencrypted email transmissions due to a failure in the STARTTLS handshake.
Which versions of Django are affected by CVE-2026-7666?
Django versions 6.0 before 6.0.6 and 5.2 before 5.2.15 are affected by CVE-2026-7666.
What is the primary cause of CVE-2026-7666?
The primary cause of CVE-2026-7666 is the reuse of a partially-initialized connection after a failed STARTTLS handshake when fail_silently=True.