CVE-2026-47194: Frappe: Host header poisoning can redirect…

Record summary

CVE-2026-47194 has a selected CVSS score of 8.6 (high); EIP currently links 1 curated repository PoC and 2 lab environments.

Description

Frappe is a full-stack web application framework. Prior to 15.108.0 and 16.18.3, temporary magic login link generation can use an attacker-controlled request Host header, allowing a remote attacker to cause emailed login links to point to an attacker-controlled domain and capture the login token when a recipient follows the link. This issue is fixed in versions 15.108.0 and 16.18.3.

Description source: CVE List

Exploitation context

Available material

Curated repository PoCs: 1
Lab environments: 2

CISA SSVC decision

ExploitationNone

AutomatableNo

Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Aug 7, 2026 · Source: CVE List

Affected products and versions

Product	Source	Version range	Status
frappe Browse frappe / frappe	CVE List	>= 16.0.0-beta.1, < 16.18.3	affected
frappe Browse frappe / frappe	CVE List	< 15.108.0	affected

Proofs of concept

Curated repository PoCs

GitHubCVE-2026-47194Curated repository PoCby exploitintel8Exploit13 files

C · 37.4 KiB

GitHub

PoC details

Analysisdeepseek-v4-pro:cloud · 2026-08-09

Technical assessment

A Python exploit script (poc/poc.py) that performs host header poisoning against Frappe Framework's magic login link feature (CVE-2026-47194). It forges the Host header in a request to send a login link, captures the resulting poisoned link from a mail sink, and replays the captured key against the real site to obtain a victim session, achieving account takeover.

Backdoor review

No backdoor observed in reviewed code

The PoC is a straightforward exploit for CVE-2026-47194 (Frappe Host header poisoning). It sends a crafted request to trigger the vulnerability, reads the resulting email from a mail sink, verifies the link points to the attacker-controlled host, replays the captured key to obtain a session, and confirms the session belongs to the victim. No concealed, deceptive, or unrelated harmful behavior is present. The code uses only standard library modules and performs exactly the actions described in the documentation.

ClassificationExploit

Model confidence100%

AuthenticationNot required

LanguagesPython

Target softwareFrappe Framework

Attack typesHost Header PoisoningAccount Takeover

Evidence & reasoningClassification basis · observed behavior · safety review

Technical evidence

Classification basis and observed behavior

Classification basis

The primary artifact is poc/poc.py, which is a standalone Python script that actively exercises the vulnerability by forging a Host header, capturing a poisoned login link, and replaying the key to take over a victim account. This constitutes exploit code as it performs the full attack chain to achieve account takeover, not merely detecting or reporting the vulnerability.

poc/poc.py:1-174README.md:96-97

Requirements

Target Frappe instance with magic login enabled (default) and no host_name pinned in site config.README.md:22-30
Access to a mail sink or victim mailbox to capture the poisoned login link.poc/poc.py:88-110
Victim must click the poisoned link within the key expiry window (default 10 minutes).README.md:39-41

Observed behavior

Sends an unauthenticated POST request to /api/method/frappe.www.login.send_login_link with a forged Host header and victim email.poc/poc.py:123-128
Polls a mail sink API to retrieve the emailed magic login link and extracts the one-time key.poc/poc.py:88-110
Validates that the extracted link points to the attacker-controlled host, confirming the poisoning.poc/poc.py:140-148
Replays the captured key against the real target site to obtain a session cookie (sid).poc/poc.py:150-160
Uses the obtained session to call frappe.auth.get_logged_user and confirms the session belongs to the victim.poc/poc.py:162-170

Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Network Request: Payload withheldTriggers the CVE by requesting a magic login link with an attacker-controlled Host header.poc/poc.py:124-128
Network Request: Payload withheldPolls the mail sink to retrieve the poisoned magic link and extract the one-time key.poc/poc.py:94-108
Network Request: Payload withheldReplays the captured key against the real site to obtain a victim session cookie.poc/poc.py:154
Network Request: Payload withheldVerifies the obtained session belongs to the victim email, confirming account takeover.poc/poc.py:163

Review boundaries

What the analysis did not establish

The evidence includes only the text of README.md, poc/poc.py, and poc_verification_report.md. Other files in the repository unit (e.g., Dockerfiles, docker-compose files, seed scripts) are reported but their contents are not provided, so the full lab environment cannot be independently verified from the supplied evidence alone.
The exploit script relies on a Mailpit API as a stand-in for a real victim mailbox; real-world exploitation would require a different method to capture the poisoned link.
Only the three selected text files (README.md, poc/poc.py, poc_verification_report.md) were reviewed. The artifact contains 10 additional unclassified files (e.g., Dockerfiles, shell scripts, configuration files) that were not analyzed. No binary files were identified, but the binary policy is FLAGGED_METADATA_ONLY_NOT_ANALYZED.

Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Docker lab environments

GitHub

CVE-2026-47194/docker-compose.control.yml

CVE-2026-47194Created 2026-05-19Vuln labCVE-2026-47194Compose · mixed

1 Compose manifest · 1 Dockerfile · 4 services

View exploit

Analysisdeepseek-v4-pro:cloud · 2026-08-09

Environment assessment

A Docker Compose environment for demonstrating CVE-2026-47194, a host header poisoning vulnerability in Frappe Framework's magic login links. It includes a patched Frappe web service (v15.108.0), MariaDB, Redis, and a Mailpit SMTP sink. The environment is designed to show that the patched version ignores a forged Host header, causing the exploit to fail.

CVE-2026-47194/README.md:1-129CVE-2026-47194/docker-compose.control.yml:1-48

Lab assessment

Vulnerability lab

The README explicitly describes the environment as a 'Lab' for CVE-2026-47194, with a patched control stack to verify the fix. The compose file and Dockerfile build a specific vulnerable component (Frappe) and supporting services to exercise the vulnerability.

CVE-2026-47194/README.md:1-129CVE-2026-47194/docker-compose.control.yml:1-48

Lab shapeCompose · mixed

Services4

Compose manifests1

Dockerfiles1

Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries

Components

Services and files described by the evidence

web

patched Frappe application server

Builds Frappe v15.108.0 (first fixed version) from a pinned, checksum-verified source tarball. Serves the application on port 8080, mapped to host port 8081. The CMD pins the site to 'site1.local' and disables reload/threading. The Dockerfile copies a common_site_config.json that points to the db, redis, and smtp services.

CVE-2026-47194/docker-compose.control.yml:30-48CVE-2026-47194/Dockerfile.patched:1-53CVE-2026-47194/common_site_config.json:1-13

db

database

MariaDB 10.6 with root password 'root', configured with specific character set and collation options. Healthcheck ensures the database is initialized before dependent services start.

CVE-2026-47194/docker-compose.control.yml:2-16

redis

cache and queue backend

Redis 7 Alpine image used for caching and queuing. Healthcheck verifies connectivity via redis-cli ping.

CVE-2026-47194/docker-compose.control.yml:18-25

smtp

mail sink

Mailpit image (axllent/mailpit:latest) used to capture outgoing emails. Port 8025 is exposed on host port 8026. No authentication is configured, matching the site config.

CVE-2026-47194/docker-compose.control.yml:27-29CVE-2026-47194/common_site_config.json:8-10

CVE assessment

How the supplied evidence relates each vulnerability

CVE-2026-47194

Supported by supplied evidence

The README, PoC script, and verification report all describe the vulnerability and confirm that the patched version (15.108.0) used in this control environment ignores the forged Host header, causing the exploit to fail. The Dockerfile builds the exact fixed version, and the compose file maps the web service to a distinct port (8081) for control testing.

CVE-2026-47194/README.md:1-129CVE-2026-47194/poc_verification_report.md:1-59CVE-2026-47194/Dockerfile.patched:17-18

Exercise context

Requirements and sequence described by the evidence

Prerequisites

Docker and Docker Compose must be installed to build and run the environment.CVE-2026-47194/README.md:85-87
The seed script (seed.sh) must be run after the stack is up to create the Frappe site and victim user.CVE-2026-47194/README.md:88-89CVE-2026-47194/seed.sh:1-51
The PoC script requires Python 3 and network access to the target web service and mail sink.CVE-2026-47194/poc/poc.py:1-174

Evidence-described exercise path

Build and start the patched control stack: docker compose -f docker-compose.control.yml -p cve-2026-47194-control up -dCVE-2026-47194/README.md:93
Run the seed script to create the site and victim user: bash seed.sh docker-compose.control.yml cve-2026-47194-control 8081CVE-2026-47194/README.md:94
Execute the PoC against the patched target: python3 poc/poc.py http://127.0.0.1:8081 victim@lab.local evil.attacker.tld http://127.0.0.1:8026CVE-2026-47194/README.md:95
Observe that the PoC prints [FAILED] because the patched server ignores the forged Host header and builds the link with the server-side host.CVE-2026-47194/README.md:96CVE-2026-47194/poc_verification_report.md:20

Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

All visible behavior is directed at the lab's own target services. The web service is built from a pinned, checksum-verified source and serves only on localhost-mapped ports. The PoC script interacts exclusively with the lab's web and mail services to demonstrate the vulnerability. No evidence of host escape, external connections, persistence, credential theft, or destructive actions is present.

CVE-2026-47194/docker-compose.control.yml:1-48CVE-2026-47194/Dockerfile.patched:1-53CVE-2026-47194/poc/poc.py:1-174

Review boundaries

What the analysis did not establish

The packet includes only the patched control compose file (docker-compose.control.yml) and Dockerfile (Dockerfile.patched). The vulnerable compose file and Dockerfile are referenced but not included in the evidence, so the vulnerable stack cannot be fully assessed.
The PoC script (poc.py) is a Python script that makes HTTP requests to the lab services; its behavior is fully visible in the source code, but its runtime effects depend on the lab state.
The seed script (seed.sh) executes docker exec commands to create a site and user inside the web container; this is expected lab setup but could be considered privileged container access.

Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

GitHub

CVE-2026-47194/docker-compose.yml

CVE-2026-47194Created 2026-05-19Vuln labCVE-2026-47194Compose · mixed

1 Compose manifest · 1 Dockerfile · 4 services

View exploit

Analysisdeepseek-v4-pro:cloud · 2026-08-09

Environment assessment

A Docker Compose environment for reproducing CVE-2026-47194, a host header poisoning vulnerability in Frappe Framework's magic login links. It consists of four services: a vulnerable Frappe web application (15.107.5), MariaDB, Redis, and a Mailpit SMTP sink to capture poisoned emails.

CVE-2026-47194/docker-compose.yml:1-48CVE-2026-47194/README.md:1-129

Lab assessment

Vulnerability lab

The README explicitly describes the environment as a lab for CVE-2026-47194, with a vulnerable target, a patched control, and a proof-of-concept exploit. The Dockerfile builds a specific vulnerable version of Frappe, and the compose file orchestrates the required services.

CVE-2026-47194/README.md:1-129CVE-2026-47194/Dockerfile.vulnerable:1-54

Lab shapeCompose · mixed

Services4

Compose manifests1

Dockerfiles1

Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries

Components

Services and files described by the evidence

web

vulnerable Frappe applicationtarget of host header poisoning

Builds Frappe 15.107.5 from a pinned source tarball, serves the application on port 8080, and is configured without a host_name in site config, making it vulnerable to Host header poisoning in magic login links.

CVE-2026-47194/docker-compose.yml:30-48CVE-2026-47194/Dockerfile.vulnerable:1-54CVE-2026-47194/common_site_config.json:1-13

db

database backend

MariaDB 10.6 database used by the Frappe application, configured with a root password and healthcheck.

CVE-2026-47194/docker-compose.yml:2-16

redis

cache and queue backend

Redis 7 Alpine instance used by Frappe for caching, queuing, and socketio, with a healthcheck.

CVE-2026-47194/docker-compose.yml:18-25

smtp

mail sink for capturing poisoned emails

Mailpit instance that captures emails sent by the Frappe application, allowing the exploit to retrieve the poisoned magic link. Exposes port 8025 for API access.

CVE-2026-47194/docker-compose.yml:27-29

CVE assessment

How the supplied evidence relates each vulnerability

CVE-2026-47194

Supported by supplied evidence

The environment is explicitly built to demonstrate CVE-2026-47194. The Dockerfile pins the vulnerable version 15.107.5, the README details the vulnerability and attack chain, and the PoC script exploits the described Host header poisoning in magic login links.

CVE-2026-47194/README.md:1-129CVE-2026-47194/Dockerfile.vulnerable:1-54CVE-2026-47194/poc/poc.py:1-174

Exercise context

Requirements and sequence described by the evidence

Prerequisites

Docker and Docker Compose must be installed to build and run the environment.CVE-2026-47194/README.md:1-129
The Frappe site must be created and seeded with a victim user (victim@lab.local) using seed.sh after the stack is up.CVE-2026-47194/seed.sh:1-51
The vulnerable Frappe instance must have login_with_email_link enabled (default) and no host_name in site config (default).CVE-2026-47194/README.md:1-129CVE-2026-47194/create_user.py:1-23

Evidence-described exercise path

Build and start the vulnerable stack: docker compose build && docker compose up -dCVE-2026-47194/README.md:1-129
Seed the Frappe site and create the victim user: bash seed.shCVE-2026-47194/seed.sh:1-51
Run the PoC exploit: python3 poc/poc.py http://127.0.0.1:8080 victim@lab.local evil.attacker.tld http://127.0.0.1:8025CVE-2026-47194/poc/poc.py:1-174
Observe the exploit output: the script requests a magic link with a forged Host header, captures the poisoned link from the mail sink, replays the key against the real site, and confirms account takeover as victim@lab.local.CVE-2026-47194/poc/poc.py:1-174

Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

All visible behavior is directed at the lab's own target (the vulnerable Frappe web service) and the mail sink. The exploit only interacts with the local lab services (127.0.0.1:8080 and 127.0.0.1:8025) to demonstrate the vulnerability. There is no evidence of host escape, external connections, persistence, credential theft, or destructive actions beyond the intended lab exercise.

CVE-2026-47194/poc/poc.py:1-174CVE-2026-47194/docker-compose.yml:1-48

Review boundaries

What the analysis did not establish

The packet does not include the patched Dockerfile (Dockerfile.patched) or the control compose file (docker-compose.control.yml) as evidence files, though they are referenced in the README and file inventory.
The PoC script uses a forged Host header 'evil.attacker.tld' which does not resolve; in a real attack, an attacker would need a server to capture the key, but the lab uses Mailpit as a stand-in.
The analysis is based solely on static file content; no runtime behavior was observed.

Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

References

github.comConfirmation

https://github.com/frappe/frappe/security/advisories/GHSA-3w78-3cj3-p949