CVE-2026-47160: Vaultwarden: Server-side request forgery (SSRF) via Icon Endpoint Decimal/Hex/Octal IP Bypass
Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to 1.36.0, Vaultwarden's /icons/{domain}/icon.png endpoint used src/httpclient.rs checks including shouldblockaddress() and postresolve() that missed decimal, hexadecimal, and octal IP representations, allowing SSRF through the icon-fetching HTTP client for blind internal network or port discovery. This issue is fixed in version 1.36.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
vaultwardento a version that resolves this vulnerability.Fixed in 1.36.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-47160?
CVE-2026-47160 has a medium severity rating of 5.8.
What vulnerability does CVE-2026-47160 describe?
CVE-2026-47160 describes a server-side request forgery (SSRF) vulnerability in Vaultwarden due to insufficient validation of IP address formats.
How do I fix CVE-2026-47160?
To fix CVE-2026-47160, update Vaultwarden to version 1.36.0 or newer where the vulnerability is addressed.
What is the impact of CVE-2026-47160?
The impact of CVE-2026-47160 includes potential unauthorized access to internal services through SSRF exploitation.
Is CVE-2026-47160 applicable to all versions of Vaultwarden?
CVE-2026-47160 is applicable to Vaultwarden versions prior to 1.36.0.