CVE-2026-48842: Roundcube Pre-Auth SQLi Exploited in Wild

Executive Summary

A pre-authentication SQL injection in Roundcube Webmail is being exploited in the wild, according to a warning from the Canadian Centre for Cyber Security. The flaw, tracked as CVE-2026-48842, carries a CVSS score of 8.1 and affects the virtuser_query plugin in Roundcube versions 1.6.x before 1.6.16 and 1.7.x before 1.7.1. Patches are available, and organizations running exposed webmail instances should treat the update as urgent.

The practical risk is straightforward: the vulnerability is reachable before authentication, meaning an attacker does not need valid mailbox credentials to reach the vulnerable code path. Roundcube is widely deployed as a webmail front end for IMAP servers, including in shared hosting environments and enterprise mail stacks, which broadens the pool of potentially exposed targets. The Canadian Centre for Cyber Security's advisory is the authoritative source for the exploitation claim; The Hacker News reported the warning.

Technical Analysis

The vulnerability is a SQL injection in the virtuser_query plugin. According to the advisory summary, the issue stems from improper handling in a preg_replace() call involving backslash characters, which allows attacker-controlled input to reach a SQL query without adequate sanitization. Because the flaw is pre-authentication, exploitation does not require a valid session or mailbox account.

The affected version ranges are specific: Roundcube Webmail 1.6.x before 1.6.16, and 1.7.x before 1.7.1. The fix is delivered in 1.6.16 and 1.7.1 respectively. The virtuser_query plugin is not enabled by default in all deployments, but where it is active, the vulnerable code path is reachable from unauthenticated requests.

A CVSS score of 8.1 places the flaw in the high-severity band. The score is consistent with a network-reachable, pre-auth injection that can lead to database compromise, though the advisory does not enumerate post-exploitation impact in the excerpt available. The Canadian Centre for Cyber Security's warning that the flaw is "actively exploited" is the key operational fact: this is not a theoretical proof-of-concept. The specific exploitation activity, targeted sectors, and any observed post-exploitation behavior are not detailed in the source material.

Roundcube has a history of being targeted by both opportunistic and state-linked actors because webmail is a high-value entry point into an organization's mail and, frequently, its identity infrastructure. That history, combined with confirmed in-the-wild exploitation, raises the priority of patching beyond a routine maintenance cycle.

Mitigations & Recommendations

Upgrade Roundcube Webmail to 1.6.16 or 1.7.1, depending on the deployed branch. Administrators on 1.6.x must move to at least 1.6.16; those on 1.7.x must move to at least 1.7.1. Because the flaw is pre-authentication, network-level controls are not a substitute for patching, but they can reduce exposure in the interim.

Where the virtuser_query plugin is not required, disabling it removes the vulnerable code path entirely. This is the most direct interim mitigation for deployments that cannot patch immediately. For deployments that do require the plugin, restricting access to the webmail interface to trusted networks or VPN ranges limits the population of unauthenticated attackers who can reach the injection point.

Defenders should also review webmail and database logs for anomalous SQL error patterns, unexpected query activity, or authentication-adjacent requests that do not correspond to legitimate user behavior. The source material does not provide specific indicators of compromise, so detection should focus on behavioral anomalies around the virtuser_query code path rather than signature matching. Given confirmed active exploitation, patch timelines should be measured in hours to days, not weeks.