CVE-2026-35391: fallo de gravedad alta en bulwarkmail webmail
Bulwark Webmail getClientIP() trusted client-controlled X-Forwarded-For value, enabling rate limit bypass and audit log forgery
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 8.7epss 0.1%
Bulwark Webmail is a self-hosted webmail client for Stalwart Mail Server. Prior to 1.4.11, the getClientIP() function in lib/admin/session.ts trusted the first (leftmost) entry of the X-Forwarded-For header, which is fully controlled by the client. An attacker could forge their source IP address to bypass IP-based rate limiting (enabling brute-force attacks against the admin login) or forge audit log entries (making malicious activity appear to originate from arbitrary IP addresses). This vulnerability is fixed in 1.4.11.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Productos afectados
bulwarkmail · webmailCVEs relacionadas — bulwarkmail webmail
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-113728HIGHBulwark Webmail: DNS-rebinding SSRF in public iCalendar fetch endpointEPSS 0.5%CVE-2026-34834HIGHBulwark Webmail: Authentication Bypass in verifyIdentity() due to missing cookie validationEPSS 0.3%CVE-2026-35389HIGHBulwark Webmail S/MIME signature verification accepted self-signed certificatesEPSS 0.2%CVE-2026-35390MEDIUMContent-Security-Policy was set to Report-Only mode, failing to block XSS attacksEPSS 0.2%CVE-2026-34833HIGHBulwark Webmail: Information Exposure: password returned in /api/auth/sessionEPSS 0.2%