CVE-2026-113728— Bulwark Webmail: DNS-rebinding SSRF in public iCalendar fetch endpoint
Quick assessment
Affected
bulwarkmail webmail
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Bulwark Webmail 是 Stalwart 邮件服务器的自托管 Web 邮件客户端。在 1.9.2 版本之前，未认证的 端点会对调用者提供的域名执行一次 DNS 查询进行验证，随后将 URL 传递给 函数，而该函数会为建立 socket 连接再次执行独立的 DNS 查询。若攻击者控制该域名的权威 DNS 服务器，可在验证阶段返回一个公网地址，随后在连接阶段将同一域名重新绑定至回环地址、私有地址、链路本地地址或云元数据地址，从而导致服务器返回最多 10 MB 的内部 HTTP 或 HTTPS 响应内容。相同
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-113728
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Bulwark Webmail: DNS-rebinding SSRF in public iCalendar fetch endpoint
Source: CVE Program / CVE List V5
Vulnerability Description
Bulwark Webmail is a self-hosted webmail client for Stalwart Mail Server. Prior to 1.9.2, the unauthenticated POST /api/fetch-ical endpoint validates a caller-supplied hostname with one DNS lookup and then passes the URL to fetch, which performs a separate lookup for the socket connection. An attacker controlling authoritative DNS can return a public address during validation and then rebind the hostname to a loopback, private, link-local, or cloud metadata address for the connection, causing the server to return up to 10 MB of an internal HTTP or HTTPS response. The same check-then-fetch pattern also existed in authenticated JMAP login and TOTP token-exchange flows. This issue is fixed in version 1.9.2.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
服务端请求伪造(SSRF)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| bulwarkmail | webmail | < 1.9.2 | - |
|
II. Public POCs for CVE-2026-113728
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-113728
请登录查看更多情报信息。
Other References for CVE-2026-113728 (3)
-
https://github.com/bulwarkmail/webmail/releases/tag/1.9.2 x_refsource_MISC
-
https://github.com/bulwarkmail/webmail/security/advisories/GHSA-24w9-8r42-8jwm x_refsource_CONFIRM
IV. Related Vulnerabilities
Same vendor: bulwarkmail
-
CVE-2026-35391
Bulwark Webmail getClientIP() trusted client-controlled X-Fo -
CVE-2026-35390
Content-Security-Policy was set to Report-Only mode, failing -
CVE-2026-35389
Bulwark Webmail S/MIME signature verification accepted self- -
CVE-2026-34834
Bulwark Webmail: Authentication Bypass in verifyIdentity() d -
CVE-2026-34833
Bulwark Webmail: Information Exposure: password returned in
Same weakness: CWE-918
-
CVE-2026-109682
Metasploit Framework HTTP Redirect Server-Side Request Forge -
CVE-2026-109681
Metasploit Framework FTP PASV Response SSRF -
CVE-2026-113704
a2aproject a2a-rs Push Notification push_notification_sender -
CVE-2026-113671
ApostropheCMS: Host header controls server-side image fetch -
CVE-2026-28329
SolarWinds Observability Self-Hosted Server-Side Request For
V. Comments for CVE-2026-113728
No comments yet