CVE-2026-35391
IP Spoofing in Bulwark Webmail Enables Admin Brute-Force
Publication date: 2026-04-06
Last updated on: 2026-04-09
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| bulwarkmail | webmail | to 1.4.11 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-348 | The product has two different sources of the same data or information, but it uses the source that has less support for verification, is less trusted, or is less resistant to attack. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows an attacker to forge their source IP address in the X-Forwarded-For header, which can be used to bypass IP-based rate limiting and forge audit log entries. This manipulation of audit logs can undermine the integrity and reliability of security monitoring and incident response processes.
Such weaknesses in audit logging and security controls could potentially impact compliance with standards and regulations like GDPR and HIPAA, which require accurate logging and protection against unauthorized access and tampering. However, the provided information does not explicitly state the compliance impact.
Can you explain this vulnerability to me?
The vulnerability exists in Bulwark Webmail versions prior to 1.4.11, specifically in the getClientIP() function. This function incorrectly trusts the first entry of the X-Forwarded-For header, which is controlled by the client. Because of this, an attacker can forge their source IP address.
By forging the IP address, the attacker can bypass IP-based rate limiting mechanisms designed to prevent brute-force attacks on the admin login. Additionally, the attacker can forge audit log entries, making malicious activities appear to come from arbitrary IP addresses.
This vulnerability was fixed in version 1.4.11 of Bulwark Webmail.
How can this vulnerability impact me? :
This vulnerability can allow an attacker to bypass IP-based rate limiting, enabling brute-force attacks against the admin login of Bulwark Webmail.
Such brute-force attacks could lead to unauthorized access to the admin account, compromising the security of the mail server.
Furthermore, the attacker can forge audit log entries, which can obscure their malicious activities and make it difficult to trace attacks or identify the true source of malicious actions.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, upgrade Bulwark Webmail to version 1.4.11 or later, where the issue with trusting the first entry of the X-Forwarded-For header in the getClientIP() function is fixed.