EUVD-2026-105773Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V4 - API and Web Service URL allowlisting, SSRF prevention
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Credential Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | This is a genuine but conditionally-gated SSRF (CWE-918). The strongest signal is the CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (7.5 HIGH, vendor/NVD-sourced): network-reachable and unauthenticated (PR:N) against the pre-1.9.2 /api/fetch-ical endpoint, with high confidentiality impact and no integrity/availability effect - consistent with reading internal responses (cloud metadata, loopback/private services) rather than code execution. Counterbalancing signals are largely absent or negative: no EPSS score was provided, there is no CISA KEV listing (exploitation status: no public exploit identified at time of analysis), and no SSVC decision data was supplied, so automatability and real-world exploitation cannot be scored. I assess the NVD AC:L as optimistic: successful exploitation requires the attacker to control authoritative DNS for a supplied hostname and win a TOCTOU race by rebinding between the validation lookup and the socket lookup, which is a real added barrier (I rate this AC:H independently). Net: a credible priority for cloud-hosted installs exposing an IMDSv1-style metadata endpoint, but tempered by a niche product footprint and the DNS-control/race prerequisite - not a mass-exploitation candidate on current evidence. Missing data to confirm: EPSS probability and any SSVC/automatable determination are not in the input and should be checked. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Server-side request forgery in Bulwark Webmail before 1.9.2 lets unauthenticated remote attackers read internal HTTP or HTTPS responses-potentially including cloud metadata-by rebinding a caller-supplied hostname between the DNS validation step and the socket connection. The flaw affects the unauthenticated POST /api/fetch-ical endpoint and, in authenticated paths, JMAP login and TOTP token-exchange flows, and can return up to 10 MB of a loopback, private, link-local, or metadata response. No public exploit code or active exploitation has been identified at time of analysis; the vendor-released patch in 1.9.2 validates the resolved address inside the socket lookup and adds authentication to the iCal fetch endpoint.
RemediationAI
Upgrade Bulwark Webmail to version 1.9.2, which is the vendor-released patch; the release is at https://github.com/bulwarkmail/webmail/releases/tag/1.9.2 and the fix commit is https://github.com/bulwarkmail/webmail/commit/3288589e5248dcc1da769cc578827a9ee1adc941, with details in GHSA-24w9-8r42-8jwm. The patch both adds an authentication requirement to POST /api/fetch-ical and routes all fetches-including redirect targets-through a rebinding-safe fetchPublicUrl() that validates the resolved address inside the socket lookup. If immediate upgrade is not possible, restrict outbound traffic from the webmail host so it can reach only the Stalwart server and explicitly required external iCal providers, blocking RFC1918, loopback, link-local (including 169.254.169.254), and other metadata ranges at the network or host firewall; this may break legitimate subscriptions to internal calendars or internal JMAP endpoints and requires an inventory of intended egress. As a further compensating control, disable user-supplied custom JMAP endpoints where the feature is not needed, since the TOTP and JMAP login paths also used the check-then-fetch pattern, and monitor or rate-limit requests to /api/fetch-ical for hostname patterns that resolve to multiple address families or change answers between queries.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a classic DNS-rebinding time-of-check-to-time-of-use (TOCTOU) SSRF (CWE-918) in the Next.js/TypeScript application routes of Bulwark Webmail. The pre-1.9.2 code called isPublicHttpUrl() to resolve and validate a user-supplied hostname, then passed the same URL to fetch(), which performed an independent DNS lookup for the actual socket connection. An attacker controlling the authoritative DNS for the hostname can answer the validation query with a public IP and then answer the connection query with 127.0.0.1, an RFC1918 address, a link-local address, or a cloud metadata endpoint such as 169.254.169.254. The same check-then-fetch pattern was present in the authenticated JMAP login and TOTP token-exchange flows, meaning a user-supplied custom JMAP endpoint could similarly be rebound. EUVD lists affected versions as Webmail < 1.9.2, and no CPE strings were provided in the input data. The upstream fix replaces plain fetch() with fetchPublicUrl(), which performs the public-address validation inside the socket lookup so the validated address is the one actually connected to, and it adds credential checks to /api/fetch-ical.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Primary rating from Vendor (github) · only source for this CVE.
CVSS VectorVendor: github
Lifecycle Timeline
2DescriptionCVE.org
Bulwark Webmail is a self-hosted webmail client for Stalwart Mail Server. Prior to 1.9.2, the unauthenticated POST /api/fetch-ical endpoint validates a caller-supplied hostname with one DNS lookup and then passes the URL to fetch, which performs a separate lookup for the socket connection. An attacker controlling authoritative DNS can return a public address during validation and then rebind the hostname to a loopback, private, link-local, or cloud metadata address for the connection, causing the server to return up to 10 MB of an internal HTTP or HTTPS response. The same check-then-fetch pattern also existed in authenticated JMAP login and TOTP token-exchange flows. This issue is fixed in version 1.9.2.
Technical POC Analysis
CWE-918 (SSRF) implemented as a DNS-rebinding TOCTOU: the URL is validated against a DNS answer, then fetched with a second, independent resolution that is never re-checked.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
Bulwark Webmail versions before 1.9.2 contain a server-side request forgery flaw that can expose internal HTTP responses and cloud metadata to remote attackers, creating risk of credential theft and lateral movement into cloud environments. Organizations running the affected webmail product should treat this as a high-priority exposure because a successful attack could reveal sensitive infrastructure details, though no public exploit identified at time of analysis.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Server-Side Request Forgery exploits applications that fetch remote resources based on user-supplied URLs.
Exploit-DB