GHSA-hw4g-2v3f-74x5: Vaultwarden: Icon endpoint SSRF fix bypass via second-stage favicon IP literal URLs
Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to version 1.37.0, the Vaultwarden icon downloader validates the initial icon host and DNS results but passes favicon URLs parsed from attacker-controlled HTML to getpagewithreferer() without applying shouldblockhost() to the second-stage host. This flaw bypasses the remediation for CVE-2026-47160, which covered decimal, hexadecimal, octal, and IPv4-mapped IPv6 host normalization, because the second-stage IP-literal favicon fetch does not invoke the custom DNS resolver. A remote unauthenticated attacker can provide a public page whose favicon uses an IP-literal URL, allowing the Vaultwarden server to reach loopback or private and internal addresses. The issue affects instances with internal icon downloading enabled and can expose internal responses that resemble supported images or reveal reachability through timing, status, and cache behavior. This issue is fixed in version 1.37.0.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Vaultwardento a version that resolves this vulnerability.Fixed in 1.37.0
Event History
Frequently Asked Questions
Which Vaultwarden deployments are exposed?
Instances running a version earlier than 1.37.0 are affected if internal icon downloading is enabled. The vulnerable behavior is in the server-side icon downloader.
What does an attacker need to exploit this issue?
An unauthenticated remote attacker needs to provide a publicly reachable page whose favicon URL uses an IP-literal address. The Vaultwarden server then fetches that favicon, potentially reaching loopback, private, or other internal addresses.
What could an attacker learn or access through the vulnerable fetch?
The issue can expose internal responses if they resemble supported images. Even when response content is not usable, timing, status, and cache behavior may reveal whether internal addresses are reachable.
How can exposure be reduced before upgrading?
Disable internal icon downloading if patching cannot happen immediately. Upgrade Vaultwarden to version 1.37.0 to apply the fix.