Vaultwarden EUVD-2026-111236

Exploitable only on instances with internal icon downloading enabled (i.e. ICON_SERVICE set to the internal/bundled downloader and DISABLE_ICON_DOWNLOAD not set to true) - the documented workaround of pointing ICON_SERVICE at an external provider or setting DISABLE_ICON_DOWNLOAD=true eliminates the exposure. The attacker must host a publicly routable web page whose host passes the initial should_block_host() check, and whose HTML contains a favicon (or <base>) URL using a raw IP literal (e.g. http://127.0.0.1:PORT/..., http://[::1]:PORT/..., 169.254.169.254, or private-range/IPv4-mapped IPv6 literals); IP-literal URLs are what skip reqwest's custom DNS resolver, so a domain-name second-stage URL would still be caught. Per CVSS PR:N/UI:N it needs no authentication or user interaction, but the practical payoff is limited to internal services reachable from the Vaultwarden host and whose responses either resemble supported image formats or leak information through timing, status code, or cache behavior.

This is a server-side request forgery (CWE-918) rated CVSS 5.8 with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N - network-reachable, low complexity, no privileges or user interaction, a changed scope (the server is coerced into reaching internal systems), and limited confidentiality impact only. The vuln.today decision label is 'this_month' (not act_now/emergency), consistent with a medium-severity, limited-impact SSRF rather than a drop-everything issue. No EPSS score and no CISA KEV status were supplied, so there is no signal of active or widespread exploitation; exploitation status is best described as no confirmed active exploitation. The GHSA advisory does include reporter reproduction evidence (a loopback canary hit, resolver_calls=0, 'SSRFHIT!'), so a public PoC description exists, but the input does not mark it as 'Publicly available (confirmed)' weaponized exploit code. The impact is bounded: C:L/I:N/A:N and the strongest demonstrated effect is loopback reachability plus internal probing via timing/status/cache behavior - not full read of arbitrary internal data, and cloud-metadata reach (169.254.169.254) was only a suggested regression test, not demonstrated. Net: a genuine but moderate-priority issue - real because it is remote/unauthenticated and bypasses a prior fix (CVE-2026-47160), but not a high-urgency emergency given limited impact, no KEV, and no EPSS/active-exploitation evidence. Note the dependency: risk only materializes on instances with internal icon downloading enabled.

A remote unauthenticated attacker hosts an ordinary public web page on a routable domain that passes Vaultwarden's initial icon-host validation, embedding a favicon link such as <link rel="icon" href="http://127.0.0.1:8080/favicon.ico">. When Vaultwarden's internal icon endpoint fetches and parses that page, it follows the attacker-controlled IP-literal favicon URL without re-applying should_block_host(), so reqwest connects directly to loopback/internal addresses, bypassing the custom DNS resolver allowlist. Given AV:N/AC:L/PR:N/UI:N, this is low-effort to trigger; reporters confirmed loopback reachability with a regression test, though no standalone weaponized public exploit is listed in the input.