CVE-2026-113728

Awaiting Analysis Awaiting Analysis - Queue

DNS Rebinding in Bulwark Webmail Allows Internal Data Exposure

Publication date: 2026-10-20

Last updated on: 2026-10-27

Assigner: GitHub, Inc.

Description

Bulwark Webmail is a self-hosted webmail client for Stalwart Mail Server. Prior to 1.9.2, the unauthenticated POST /api/fetch-ical endpoint validates a caller-supplied hostname with one DNS lookup and then passes the URL to fetch, which performs a separate lookup for the socket connection. An attacker controlling authoritative DNS can return a public address during validation and then rebind the hostname to a loopback, private, link-local, or cloud metadata address for the connection, causing the server to return up to 10 MB of an internal HTTP or HTTPS response. The same check-then-fetch pattern also existed in authenticated JMAP login and TOTP token-exchange flows. This issue is fixed in version 1.9.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-20

Last Modified

2026-10-27

Generated

2026-11-10

AI Q&A

2026-10-21

EPSS Evaluated

2026-11-08

NVD

CVE-2026-113728

Affected Vendors & Products

Vendor	Product	Version / Range
bulwarkmail	webmail	< 1.9.2

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-918	The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

Executive Summary

Bulwark Webmail before version 1.9.2 has a security flaw in the /api/fetch-ical endpoint. The server performs a DNS lookup to validate a hostname before fetching a URL, but the actual connection uses a separate lookup. An attacker with control over DNS can manipulate this by returning a public address during validation and then rebinding the hostname to a private or internal address during the connection, causing the server to expose up to 10 MB of internal HTTP or HTTPS responses.

Detection Guidance

This vulnerability involves DNS rebinding attacks on the POST /api/fetch-ical endpoint and authenticated JMAP/TOTP flows. Monitor network traffic for unusual DNS lookups or connections to loopback, private, or cloud metadata addresses following hostname validation. Check server logs for POST requests to /api/fetch-ical with unexpected responses larger than typical.

Impact Analysis

This vulnerability could allow an attacker to access sensitive internal data from the Bulwark Webmail server, including potentially confidential emails or server configurations. The exposed data could be up to 10 MB in size per request, posing a significant risk to data confidentiality.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements under GDPR and HIPAA, which mandate strict protection of personal and health information. A breach could result in legal penalties, reputational damage, and loss of trust.

Mitigation Strategies

Upgrade Bulwark Webmail to version 1.9.2 or later to address the issue. Implement DNS rebinding protections such as validating hostnames strictly and blocking connections to private, loopback, or cloud metadata addresses. Review and restrict access to the /api/fetch-ical endpoint and authenticated JMAP/TOTP flows.

Hi! I’m here to help you understand CVE-2026-113728. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...