CVE-2026-116678

Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to version 1.37.0, the Vaultwarden icon downloader validates the initial icon host and DNS results but passes favicon URLs parsed from attacker-controlled HTML to get_page_with_referer() without applying should_block_host() to the second-stage host. This flaw bypasses the remediation for CVE-2026-47160, which covered decimal, hexadecimal, octal, and IPv4-mapped IPv6 host normalization, because the second-stage IP-literal favicon fetch does not invoke the custom DNS resolver. A remote unauthenticated attacker can provide a public page whose favicon uses an IP-literal URL, allowing the Vaultwarden server to reach loopback or private and internal addresses. The issue affects instances with internal icon downloading enabled and can expose internal responses that resemble supported images or reveal reachability through timing, status, and cache behavior. This issue is fixed in version 1.37.0.

CVSS v3 5.8 MEDIUM

5.8^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/dani-garcia/vaultwarden/commit/46ae59eaf444f0ae0a799070cf2bd6c415284a51
https://github.com/dani-garcia/vaultwarden/pull/7472
https://github.com/dani-garcia/vaultwarden/releases/tag/1.37.0
https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-hw4g-2v3f-74x5
https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-hw4g-2v3f-74x5

Configurations

No configuration.

History

30 Oct 2026, 15:16

Type	Values Removed	Values Added
References	~~() https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-hw4g-2v3f-74x5 -~~	() https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-hw4g-2v3f-74x5 -

27 Oct 2026, 18:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-10-27 18:17

Updated : 2026-10-30 15:16

NVD link : CVE-2026-116678

Mitre link : CVE-2026-116678

CVE.ORG link : CVE-2026-116678

JSON object : View

Products Affected

No product.

CWE

CWE-918

Server-Side Request Forgery (SSRF)

{"id": "CVE-2026-116678", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-116678", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-30T14:24:36.106774Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "dani-garcia", "product": "vaultwarden", "versions": [{"status": "affected", "version": "< 1.37.0"}]}]}], "published": "2026-10-27T18:17:35.537", "references": [{"url": "https://github.com/dani-garcia/vaultwarden/commit/46ae59eaf444f0ae0a799070cf2bd6c415284a51", "source": "security-advisories@github.com"}, {"url": "https://github.com/dani-garcia/vaultwarden/pull/7472", "source": "security-advisories@github.com"}, {"url": "https://github.com/dani-garcia/vaultwarden/releases/tag/1.37.0", "source": "security-advisories@github.com"}, {"url": "https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-hw4g-2v3f-74x5", "source": "security-advisories@github.com"}, {"url": "https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-hw4g-2v3f-74x5", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-918"}]}], "descriptions": [{"lang": "en", "value": "Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to version 1.37.0, the Vaultwarden icon downloader validates the initial icon host and DNS results but passes favicon URLs parsed from attacker-controlled HTML to get_page_with_referer() without applying should_block_host() to the second-stage host. This flaw bypasses the remediation for CVE-2026-47160, which covered decimal, hexadecimal, octal, and IPv4-mapped IPv6 host normalization, because the second-stage IP-literal favicon fetch does not invoke the custom DNS resolver. A remote unauthenticated attacker can provide a public page whose favicon uses an IP-literal URL, allowing the Vaultwarden server to reach loopback or private and internal addresses. The issue affects instances with internal icon downloading enabled and can expose internal responses that resemble supported images or reveal reachability through timing, status, and cache behavior. This issue is fixed in version 1.37.0."}], "lastModified": "2026-10-30T15:16:46.500", "sourceIdentifier": "security-advisories@github.com"}