CVE-2026-54728: bunkerweb: Improper Input Validation and Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') in BunkerWeb
bunkerweb is an Open-source and next-generation Web Application Firewall (WAF). Prior to BunkerWeb 1.6.12 and BunkerWeb PRO 0.57, authenticated Host header handling in the BunkerWeb UI and API improperly validated and neutralized user-controlled input in a configuration-dependent path, allowing a low-privileged authenticated user to escalate privileges and affect confidentiality, integrity, and availability of the BunkerWeb instance. This issue is fixed in BunkerWeb version 1.6.12 and BunkerWeb PRO version 0.57.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
bunkerwebto a version that resolves this vulnerability.Fixed in 1.6.12 - Upgrade
Upgrade
bunkerweb PROto a version that resolves this vulnerability.Fixed in 0.57
Event History
Frequently Asked Questions
What is the severity of CVE-2026-54728?
CVE-2026-54728 has a medium severity rating of 6.1.
How do I fix CVE-2026-54728?
To fix CVE-2026-54728, update to BunkerWeb version 1.6.12 or BunkerWeb PRO version 0.57.
What type of vulnerability is CVE-2026-54728?
CVE-2026-54728 is characterized by improper input validation and improper neutralization of special elements in output used by a downstream component.
What component is affected by CVE-2026-54728?
CVE-2026-54728 affects the BunkerWeb UI and API due to improper handling of authenticated Host headers.
What can exploit CVE-2026-54728?
CVE-2026-54728 can potentially allow an attacker to execute injection attacks related to user-controlled input.