CVE-2026-57657: Gmail SMTP CSRF Vulnerability (v1.2.3.19 and Earlier)

Technical summary

CVE-2026-57657 is a CSRF vulnerability (CWE-352) affecting Gmail SMTP through version 1.2.3.19. The vulnerability allows unauthenticated attackers to craft cross-site requests that exploit the lack of CSRF token validation in the application. With a network-accessible attack vector and low attack complexity, the vulnerability requires only that a user interact with attacker-controlled content while maintaining an active Gmail SMTP session. The attack vector results in integrity compromise without requiring special privileges or additional authentication from the attacker.

Business impact

Organizations using Gmail SMTP in versions 1.2.3.19 or earlier face the risk of unauthorized configuration changes, email forwarding rules being secretly modified, or account settings being altered without user awareness. While the vulnerability does not grant direct access to email content or account credentials, it enables attackers to modify how email is processed or redirected. This could lead to email interception, business email compromise scenarios, compliance violations if sensitive communications are diverted, and reputational damage. The low barrier to exploitation makes this a concern even for small-scale phishing campaigns targeting specific users.

Affected systems

Gmail SMTP versions 1.2.3.19 and earlier are affected. Organizations should audit their mail server deployments and client integrations that rely on Gmail SMTP authentication to identify which versions are currently in use. The vulnerability applies across all operating systems and environments where these affected versions are deployed.

Exploitability

This vulnerability is moderately exploitable. The attack requires no special privileges, can be delivered over the network, and has low attack complexity. However, it does require user interaction—the target must visit or interact with attacker-controlled content while logged into Gmail SMTP. The vulnerability is not listed on CISA's Known Exploited Vulnerabilities (KEV) catalog, though this does not indicate absence of active exploitation. Targeted phishing campaigns delivering malicious links to specific users represent the most practical attack scenario.

Remediation

Upgrade Gmail SMTP to a version later than 1.2.3.19. Verify the specific patched version by consulting the official Gmail or Google Workspace security advisory. Organizations unable to patch immediately should consider implementing additional CSRF protections at the network or email gateway level, such as strict SameSite cookie policies, request validation rules, and user training on suspicious email links.

Patch guidance

Check Google's official security advisory for Gmail SMTP to confirm the minimum patched version that addresses CVE-2026-57657. Apply patches to all affected systems in your environment, including mail servers and any integrated applications that use Gmail SMTP for authentication or relay. Test patches in a non-production environment before broad deployment to ensure compatibility with existing email workflows and integrations.

Detection guidance

Monitor for unexpected changes to email forwarding rules, SMTP relay configuration, or authentication settings, particularly those originating from external IP ranges or atypical access patterns. Implement logging on SMTP configuration endpoints and alert on failed authentication attempts followed by successful CSRF-based modifications. Email gateway and security appliance logs may reveal suspicious cross-domain requests originating from user sessions. Consider implementing CSRF token validation audits as part of regular security assessments.

Why prioritize this

Although this is a MEDIUM severity vulnerability with limited attack scope and no direct data exfiltration, the ability to silently modify email settings poses meaningful business risk in targeted attack scenarios. Organizations with high-value users or sensitive email workflows should prioritize patching. The requirement for user interaction and lack of KEV listing suggest this is not yet actively exploited at scale, but the low barrier to crafting targeted phishing attacks warrants timely remediation.

Risk score, explained

The CVSS 3.1 score of 4.3 reflects a network-accessible, low-complexity attack that requires no attacker privileges or special access, but does require user interaction and produces only integrity impact (not confidentiality or availability). The score appropriately captures that while exploitation is feasible, the impact is narrower than remote code execution or full account takeover scenarios.

Frequently asked questions