CVE-2026-59721: Hoppscotch Root Command Execution via Malicious SMTP URL

Technical summary

CVE-2026-59721 is a command injection vulnerability in Hoppscotch versions prior to 2026.6.0. The updateInfraConfigs GraphQL mutation in admin/infra.resolver.ts fails to adequately sanitize the MAILER_SMTP_URL parameter. The validateSMTPUrl function in utils.ts permits attacker-controlled path, query, and fragment components in the URL. When nodemailer processes this URL during mail operations after a service restart, it interprets embedded sendmail transport options, allowing command execution. The vulnerability chain is: malicious URL → stored in config → parsed by nodemailer → sendmail options injected → arbitrary commands executed as root. The CWE classifications (CWE-77 Improper Neutralization of Special Elements, CWE-78 OS Command Injection, CWE-915 Improperly Controlled Modification of Dynamically-Determined Object Attributes) reflect the multi-layered nature of the flaw.

Business impact

For organizations self-hosting Hoppscotch as part of their API development infrastructure, this vulnerability poses a direct risk to backend system integrity. An admin account—whether compromised, rogue, or coerced—can gain root-level control of the Hoppscotch backend container. This enables data exfiltration from the development environment, lateral movement to other systems, persistent backdoor installation, or denial of service. In regulated industries or organizations with strict separation of duties, this may also create compliance concerns around admin privilege abuse and system logging.

Affected systems

Hoppscotch versions prior to 2026.6.0 are affected. Self-hosted deployments using nodemailer for mail functionality are at risk. Cloud-hosted or managed Hoppscotch instances should be evaluated based on the vendor's deployment model and patch status. The vulnerability requires admin access to trigger, so impact is limited to environments where admin accounts are either compromised, insufficiently protected, or where insider threats are a concern.

Exploitability

Exploitability is moderate in scope but high in impact. An attacker must first obtain admin credentials or compromise an admin account—a non-trivial step but not uncommon in targeted attacks or insider scenarios. Once admin access is established, the exploitation is straightforward: craft a malicious SMTP URL, inject it via the GraphQL API, trigger a service restart or mail operation, and gain root command execution. The CVSS score of 7.2 reflects high confidentiality, integrity, and availability impact, tempered by the high privilege requirement (PR:H). This is not a wormable, unauthenticated vulnerability, but it is a powerful privilege-escalation and lateral-movement vector within compromised environments.

Remediation

Upgrade Hoppscotch to version 2026.6.0 or later immediately. This version includes fixes to the validateSMTPUrl function that properly sanitize and reject malicious URL components. If immediate patching is not possible, restrict admin account access to trusted personnel only, enforce strong authentication (MFA if available), implement network-level access controls to the admin GraphQL endpoints, and monitor GraphQL mutation logs for suspicious updateInfraConfigs calls. Consider temporarily disabling mail functionality if it is not critical to operations.

Patch guidance

1. Review your Hoppscotch deployment version. 2. If running a version prior to 2026.6.0, plan and execute an upgrade to 2026.6.0 or the latest available release. 3. Test the upgrade in a staging environment first, particularly if you have customized mail configurations. 4. After upgrade, verify the MAILER_SMTP_URL setting and regenerate any SMTP credentials as a precaution. 5. Review admin access logs for the past 90 days to identify any suspicious updateInfraConfigs mutations. 6. Communicate the update to your team and document the change in your change management system.

Detection guidance

Monitor GraphQL mutation logs for calls to updateInfraConfigs with unusual MAILER_SMTP_URL values, especially those containing path, query, or fragment segments that look like command-injection payloads (e.g., semicolons, pipes, backticks, or shell metacharacters). Implement alerting for admin API calls outside normal business hours or from unexpected IP addresses. Review system-level audit logs on the backend container for sendmail or process execution commands initiated by the mail service, particularly after service restarts. Check for unexpected child processes spawned by the mail daemon. If you use a SIEM, correlate GraphQL audit logs with container runtime events.

Why prioritize this

This vulnerability merits high priority because it results in root-level command execution on a critical development infrastructure component. Although it requires admin privilege, the impact is severe: a compromised admin account becomes a full system compromise. In environments where API development infrastructure is used for testing, staging, or integration with production systems, this poses a risk to downstream systems. The fix is straightforward (upgrade to 2026.6.0), making swift patching feasible.

Risk score, explained

CVSS 3.1 score of 7.2 (HIGH) reflects: Network-accessible attack vector (AV:N), low attack complexity (AC:L), high privilege requirement (PR:H), no user interaction needed (UI:N), and high impact on confidentiality, integrity, and availability (C:H/I:H/A:H). The high privilege requirement prevents a scoring of 'Critical,' but the severity of impact (root code execution) and the relative ease of exploitation once admin access is obtained justify the HIGH rating. Organizations with strong admin access controls may tolerate slightly lower risk; those with weak or distributed admin credentials should treat this as critical.

Frequently asked questions