CVE-2026-116678 in Vaultwarden
Summary
by MITRE • 10/27/2026
Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to version 1.37.0, the Vaultwarden icon downloader validates the initial icon host and DNS results but passes favicon URLs parsed from attacker-controlled HTML to get_page_with_referer() without applying should_block_host() to the second-stage host. This flaw bypasses the remediation for CVE-2026-47160, which covered decimal, hexadecimal, octal, and IPv4-mapped IPv6 host normalization, because the second-stage IP-literal favicon fetch does not invoke the custom DNS resolver. A remote unauthenticated attacker can provide a public page whose favicon uses an IP-literal URL, allowing the Vaultwarden server to reach loopback or private and internal addresses. The issue affects instances with internal icon downloading enabled and can expose internal responses that resemble supported images or reveal reachability through timing, status, and cache behavior. This issue is fixed in version 1.37.0.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/27/2026
Vaultwarden serves as a popular open-source implementation of the Bitwarden password manager server, written in Rust to provide compatibility with official clients while offering greater flexibility for self-hosted deployments. A critical security flaw was identified within versions prior to 1.37.0 concerning the application's icon downloading mechanism. This component is responsible for fetching and caching website icons to enhance user experience by displaying recognizable logos next to stored credentials in the web vault interface. The vulnerability arises from an inconsistent implementation of host validation logic during this process, specifically affecting how second-stage resources are handled after initial page retrieval.
The technical root cause lies in a discrepancy between the security checks applied to different stages of resource fetching. When Vaultwarden downloads icons, it first validates the primary host and DNS results using strict filtering mechanisms designed to prevent access to internal or loopback addresses. However, when parsing favicon URLs from attacker-controlled HTML content, the application passes these URLs directly to an internal function for retrieval without applying the same blocking logic used in the initial stage. This oversight means that while the first request is sanitized against SSRF vectors, subsequent requests derived from the page's metadata bypass these protections entirely.
This flaw effectively circumvents previous remediation efforts related to CVE-2026-47160, which addressed various host normalization issues including decimal, hexadecimal, octal, and IPv4-mapped IPv6 formats. Although those fixes improved general resilience against complex SSRF techniques, they did not account for the specific path where favicon URLs are processed independently of the main validation pipeline. Consequently, an attacker can craft a public webpage that references its favicon using an IP-literal URL pointing to internal network ranges such as loopback addresses or private subnets. When a Vaultwarden user views this page, the server automatically attempts to fetch the icon, triggering the unvalidated request path and allowing the application to communicate with internal services.
The operational impact of this vulnerability is significant for any instance that has internal icon downloading enabled by default configuration. An unauthenticated remote attacker can leverage this flaw to perform Server-Side Request Forgery attacks against internal infrastructure accessible from the Vaultwarden server's network environment. The attack allows the retrieval of responses from internal services, which may resemble supported image formats or reveal service availability through timing differences, HTTP status codes, and cache behavior. This capability enables reconnaissance activities where an attacker can map out internal networks, identify running services on non-standard ports, or potentially extract sensitive data if those internal services return content that can be interpreted as valid images by the caching mechanism.
From a classification perspective, this vulnerability aligns with CWE-918 Server-Side Request Forgery (SSRF), specifically involving improper restriction of web server requests to specified domains or IP addresses. It also maps to MITRE ATT&CK technique T1571.002 Non-Standard Port, as the attacker can probe internal services running on various ports by analyzing response characteristics. The lack of consistent validation across all request paths represents a classic logic error where security controls are applied selectively rather than universally throughout the application's data flow.
Mitigation requires immediate upgrading to Vaultwarden version 1.37.0 or later, which corrects this inconsistency by ensuring that favicon URLs undergo the same rigorous host validation and DNS resolution checks as other resources. Administrators should also verify their deployment configurations to ensure that internal icon downloading is disabled if not strictly necessary for their use case, thereby reducing the attack surface even further. Regular auditing of third-party dependencies and continuous integration testing for SSRF vectors are recommended practices to prevent similar logic flaws in future updates.