CVE-2026-35391 Security feature bypass in webmail
Attackers can spoof IP addresses via X-Forwarded-For to bypass rate limits and forge audit logs in Bulwark Webmail.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-35391?
CVE-2026-35391 is a high-severity vulnerability in bulwarkmail webmail, published on 6 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Bulwark Webmail is a self-hosted webmail client for Stalwart Mail Server. Prior to 1.4.11, the getClientIP() function in lib/admin/session.ts trusted the first (leftmost) entry of the X-Forwarded-For header, which is fully controlled by the client. An attacker could forge their source IP address to bypass IP-based rate limiting (enabling brute-force attacks against the admin login) or forge audit log entries (making malicious activity appear to originate from arbitrary IP addresses). This vulnerability is fixed in 1.4.11.
Weakness: CWE-348
Which versions are affected by CVE-2026-35391?
It affects 1 product.
Products include Bulwarkmail Webmail.
How do I fix CVE-2026-35391?
No fix has been published for CVE-2026-35391 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-35391 being exploited?
There is no known exploitation of CVE-2026-35391 in the wild and no public exploit code.
Other vulnerabilities in bulwarkmail webmail
- CVE-2026-35389 Bulwark Webmail S/MIME signature verification accepted self-signed certificates
- CVE-2026-34833 Bulwark Webmail: Information Exposure: password returned in /api/auth/session
- CVE-2026-34834 Bulwark Webmail: Authentication Bypass in verifyIdentity() due to missing cookie validation
- CVE-2026-35390 Content-Security-Policy was set to Report-Only mode, failing to block XSS attacks
Sources
Also known as GHSA-7pj2-232x-6698.