BunkerWeb CVE-2026-75514

Exploitation requires two specific conditions to be met simultaneously. First, the target BunkerWeb deployment must have rDNS-based configuration active - at least one of IGNORE_RDNS (blacklist module), GREYLIST_RDNS (greylist module), or ANTIBOT_IGNORE_RDNS (antibot module) must be populated with a trusted suffix pattern; deployments that do not configure any of these rDNS options are not exposed to this bypass. Second, the attacker must control a PTR record for their source IP - this requires reverse DNS delegation authority over the IP block, commonly available through VPS or dedicated server providers (e.g., Hetzner, DigitalOcean, Vultr). No authentication to the BunkerWeb host or any application account is required. What limits exploitation is the AC:H DNS prerequisite and the fact that only deployments actively using rDNS-based access control are affected; default BunkerWeb configurations that rely on IP-based or other non-rDNS rules are not vulnerable to this specific bypass.

The CVSS 3.1 vector AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N scores 5.9 (Medium), accurately reflecting that while the attack is fully remote and unauthenticated, exploitation requires non-trivial DNS infrastructure - the attacker must control a reverse DNS delegation for their source IP, typically obtained via a VPS or dedicated hosting provider. No EPSS score was provided in the input, and the CVE is not listed in the CISA KEV catalog, so widespread opportunistic exploitation is not confirmed. The integrity impact is high because successful exploitation allows complete bypass of WAF security controls - blacklist evasion, forced greylist promotion, or antibot challenge skip - which could enable follow-on attacks against the protected application. No public exploit code has been identified at time of analysis. The AC:H rating means mass automated exploitation is unlikely compared to AC:L vulnerabilities; this vulnerability is most relevant to deployments that are actively targeted by an adversary with the capability to configure DNS infrastructure, rather than broad spray-and-pray campaigns.

An attacker acquires a VPS or dedicated server from a hosting provider that permits custom PTR records, then sets their IP's reverse DNS to a hostname ending in a suffix matching the target's IGNORE_RDNS or GREYLIST_RDNS pattern (e.g., trusted.example.com if the operator has whitelisted .example.com). When the attacker sends HTTP requests to the BunkerWeb-protected application, the WAF resolves the PTR record, matches the spoofed suffix, and grants blacklist bypass or greylist treatment without verifying the hostname forward-resolves to the attacker's IP. No public proof-of-concept code has been identified, but the technique is well-understood in the context of FCrDNS bypass research.