A pre-auth SQL injection in Roundcube Webmail (CVE-2026-48842) is being actively exploited. Here's what's affected and what you need to do right now.
### The Warning Nobody Wants to Hear
If your team runs Roundcube Webmail, this one deserves your full attention right now. The Canadian Centre for Cyber Security has issued a warning about a now-patched vulnerability that's being actively exploited in the wild. Not theoretical. Not a proof-of-concept sitting on some researcher's laptop. Real attackers, real targets, real damage.
The flaw is tracked as CVE-2026-48842, and it carries a CVSS score of 8.1. That's high. That's the kind of number that makes security teams cancel their afternoon plans.
### What Exactly Is CVE-2026-48842?
This is a pre-authentication SQL injection in the virtuser_query plugin. Let me break that down, because the "pre-auth" part is what makes it scary.
Most vulnerabilities require an attacker to log in first. That's a barrier. It means they need credentials, which means they need to have already compromised something. Pre-authentication means they don't. They can hit your system from the outside, unauthenticated, and start poking at your database before you even know they're there.
The affected versions are:
- Roundcube Webmail 1.6.x before 1.6.16
- Roundcube Webmail 1.7.x before 1.7.1
The root cause? A preg_replace() backslash issue in the plugin's handling of user input. It's the kind of subtle coding mistake that slips through review because it looks harmless. Until someone figures out how to weaponize it.
### Why SQL Injection Still Matters in 2026
I know. SQL injection feels like the cybersecurity equivalent of a flip phone. We've been talking about it for two decades. Shouldn't it be solved by now?
Here's the thing: it's not about whether the technique is old. It's about whether the code is clean. And in a sprawling open-source project with plugins contributed by different developers over many years, edge cases happen. A single backslash in the wrong place can open a door that nobody noticed was there.
> "The most dangerous vulnerabilities aren't the ones that look complicated. They're the ones that look boring enough that everyone assumes someone else already checked."
That's what makes this Roundcube flaw worth talking about. It's not exotic. It's just effective.
### What Should You Do Right Now?
First, check your version. If you're running anything in the affected ranges, stop reading and go patch. The fix is already out. Roundcube 1.6.16 and 1.7.1 address the issue.
Second, if you can't patch immediately, consider disabling the virtuser_query plugin until you can. It's not ideal, but it's better than leaving the door open.
Third, think about what an attacker could have already done. SQL injection doesn't just read data. Depending on permissions, it can modify records, drop tables, or pivot to other systems. If your instance was exposed to the internet, assume the worst and check your logs.
### The Bigger Lesson Here
Webmail servers are juicy targets. They hold email, contacts, calendar data, and often serve as a gateway to everything else. Attackers know this. That's why they move fast when a pre-auth flaw drops.
The gap between "patch released" and "patch applied" is where breaches live. Every hour you wait is an hour someone else is scanning for you.
So if you're responsible for a Roundcube instance, this is your nudge. Update it. Then go check the other things you've been meaning to update. Because next time, the warning might come after the damage is done.
