CVE-2026-113728: high-severity vulnerability in bulwarkmail webmail
Bulwark Webmail: DNS-rebinding SSRF in public iCalendar fetch endpoint
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7.5epss 0.5%
Bulwark Webmail is a self-hosted webmail client for Stalwart Mail Server. Prior to 1.9.2, the unauthenticated POST /api/fetch-ical endpoint validates a caller-supplied hostname with one DNS lookup and then passes the URL to fetch, which performs a separate lookup for the socket connection. An attacker controlling authoritative DNS can return a public address during validation and then rebind the hostname to a loopback, private, link-local, or cloud metadata address for the connection, causing the server to return up to 10 MB of an internal HTTP or HTTPS response. The same check-then-fetch pattern also existed in authenticated JMAP login and TOTP token-exchange flows. This issue is fixed in version 1.9.2.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected products
bulwarkmail · webmailRelated CVEs — bulwarkmail webmail
In the same product, most dangerous first.
CVE-2026-34834HIGHBulwark Webmail: Authentication Bypass in verifyIdentity() due to missing cookie validationEPSS 0.3%CVE-2026-35389HIGHBulwark Webmail S/MIME signature verification accepted self-signed certificatesEPSS 0.2%CVE-2026-34833HIGHBulwark Webmail: Information Exposure: password returned in /api/auth/sessionEPSS 0.2%CVE-2026-35390MEDIUMContent-Security-Policy was set to Report-Only mode, failing to block XSS attacksEPSS 0.2%CVE-2026-35391HIGHBulwark Webmail getClientIP() trusted client-controlled X-Forwarded-For value, enabling rate limit bypass and audit log forgeryEPSS 0.1%