BunkerWeb CVE-2026-54728

The attacker must hold a valid low-privileged authenticated account on the BunkerWeb UI or API (PR:L per CVSS vector - unauthenticated exploitation is not possible). The vulnerable code path is the create_token_for_role function, which is invoked during authentication when a Biscuit token is issued; the attacker must control the HTTP Host header at the moment of token creation. The CVSS 4.0 AT:P and the description's 'configuration-dependent path' indicate that specific deployment or configuration conditions must be met - the precise configuration trigger is not enumerated in available data, but is inferred from the vector. Limiting factors: no unauthenticated path exists; high attack complexity (AC:H) reflects the precision required to inject syntactically valid Datalog; the attack scope is bounded to the BunkerWeb instance itself (SC:N/SI:N/SA:N), not downstream protected services.

The CVSS 4.0 vector AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:H/VA:H reflects genuine exploitation complexity: AC:H and AT:P signal that specific preconditions and non-default configurations gate the attack path. The asymmetric impact (low confidentiality, high integrity and availability) is consistent with privilege escalation to an administrative role within the WAF instance. The 6.1 Medium score is appropriate - this is not a trivial flaw, but it is gated by the requirement for an authenticated low-privileged account. Real-world priority is elevated for organizations where BunkerWeb accounts are shared or issued to multiple parties, since any account holder could escalate. KEV: not listed in CISA KEV. No public POC identified, though the public commit diff makes the injection vector transparent. EPSS data not provided. The configuration-dependent qualifier in the description and AT:P in the vector indicate this may not trigger in all deployment modes - defenders should verify whether the Biscuit token path is active in their specific deployment.

An attacker with a low-privileged BunkerWeb account (e.g., a reader role) sends an authentication or API request with a crafted Host header such as legit-host"; admin(true); extra_fact("injected - the BunkerWeb server incorporates this value via f-string interpolation into a Biscuit Datalog builder string, signing the injected facts into the resulting token. The attacker then presents this token to the API, where the Datalog authorizer evaluates the injected facts as signed and trusted, granting elevated privileges and enabling modification or disruption of WAF configuration and operations.