CVE-2026-116678: Vaultwarden: Icon endpoint SSRF fix bypass via second-stage favicon IP literal URLs
Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to version 1.37.0, the Vaultwarden icon downloader validates the initial icon host and DNS results but passes favicon URLs parsed from attacker-controlled HTML to getpagewithreferer() without applying shouldblockhost() to the second-stage host. This flaw bypasses the remediation for CVE-2026-47160, which covered decimal, hexadecimal, octal, and IPv4-mapped IPv6 host normalization, because the second-stage IP-literal favicon fetch does not invoke the custom DNS resolver. A remote unauthenticated attacker can provide a public page whose favicon uses an IP-literal URL, allowing the Vaultwarden server to reach loopback or private and internal addresses. The issue affects instances with internal icon downloading enabled and can expose internal responses that resemble supported images or reveal reachability through timing, status, and cache behavior. This issue is fixed in version 1.37.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Vaultwardento a version that resolves this vulnerability.Fixed in 1.37.0
Event History
Frequently Asked Questions
Which deployments are exposed?
Vaultwarden instances running a version prior to 1.37.0 with internal icon downloading enabled are affected. The vulnerable behavior occurs when the server downloads icons for attacker-controlled public pages.
What does an attacker need to exploit this?
An unauthenticated remote attacker needs to provide a public page whose attacker-controlled HTML specifies a favicon URL using an IP-literal address. The Vaultwarden server then performs the second-stage favicon fetch and may reach loopback, private, or other internal addresses.
What could an attacker learn or access through this issue?
The issue can expose responses from internal services when those responses resemble supported images. Even where response content is not usable, timing, status, and cache behavior may reveal whether internal addresses are reachable.
What can be done before upgrading?
Disable internal icon downloading if upgrading to version 1.37.0 is not immediately possible. This removes the affected icon-download path described for vulnerable instances.