CVE-2021-26911: Canarymail Canary Mail

High severity, CVSS 7.4. EPSS: 1.1% chance of exploitation in the next 30 days.

core/imap/MCIMAPSession.cpp in Canary Mail before 3.22 has Missing SSL Certificate Validation for IMAP in STARTTLS mode.

Affected products

• Canarymail Canary Mail: version 3.20 only; version 3.21 only
• Libmailcore MAILCORE2: version 0.6.4 only

Published 2021-02-17. Last modified 2026-06-17.