Reference page — cumulative record through Saturday, October 3, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2026-101281

CVE-2026-101281MEDIUM

Trusted Domain Project OpenDMARC SPF Macro opendmarc_spf.c opendmarc_sp2_find_mailfrom_domain improper authentication

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   L   L   L    5.5   .0041   32.9     —

AFFECTED
  Product    Versions  Fixed
  OpenDMARC  1.4.0 –   —

TIMELINE
  Sep 28  Reserved by VulDB
  Sep 29  Published (CNA: VulDB)
  Oct 1   EXPLOIT PUBLISHED — CVE-2026-101281 (Trusted Domain Project OpenDMARC). Public exploit reference added.

CWE-287 · CNA: VulDB · CVSS v4.0 · 8 references · NVD status: Deferred

Description

A flaw has been found in Trusted Domain Project OpenDMARC up to 1.4.2. Affected by this vulnerability is the function opendmarc_sp2_find_mailfrom_domain of the file libopendmarc/opendmarc_spf.c of the component SPF Macro Handler. This manipulation causes improper authentication. The attack is possible to be carried out remotely. The exploit has been published and may be used. Patch name: c48a74c758677fc5272a73eff15ffdbf8afda1a6. Applying a patch is the recommended action to fix this issue.

Lifecycle

Complete event history — 3 events, chronological
Date	Event	Detail
September 28, 2026	Reserved	Reserved by VulDB
September 29, 2026	Published	Published (CNA: VulDB)
October 1, 2026	EXPLOIT PUBLISHED	EXPLOIT PUBLISHED — CVE-2026-101281 (Trusted Domain Project OpenDMARC). Public exploit reference added.

Affected

Affected products and packages — 1 row
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
Trusted Domain Project	OpenDMARC	—	1.4.0	—

Weaknesses

CWE-287

References (8)

Authoritative record: CVE-2026-101281 at cve.org

Vendors: trusted domain project

Weaknesses: CWE-287

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-101281 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Saturday, October 3, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.