PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-35391 Bulwarkmail CVE debrief

CVE-2026-35391 is a high-severity vulnerability in Bulwark Webmail, a self-hosted webmail client for Stalwart Mail Server. The getClientIP() function in lib/admin/session.ts was trusting the first entry of the X-Forwarded-For header, allowing an attacker to forge their source IP address. This could bypass IP-based rate limiting, enabling brute-force attacks against the admin login, or forge audit log entries, making malicious activity appear to originate from arbitrary IP addresses. The vulnerability is fixed in version 1.4.11. Administrators and users of Bulwark Webmail, especially those who have not upgraded to version 1.4.11, should be aware of this vulnerability and take necessary precautions to protect their systems.

Vendor
Bulwarkmail
Product
Webmail
CVSS
HIGH 8.7
CISA KEV
Not listed in stored evidence
Original CVE published
2026-04-06
Original CVE updated
2026-07-24
Advisory published
2026-04-06
Advisory updated
2026-07-24

Who should care

Administrators and users of Bulwark Webmail, especially those who have not upgraded to version 1.4.11, should be aware of this vulnerability and take necessary precautions to protect their systems. This includes reviewing system configurations, monitoring for suspicious activity, and prioritizing upgrades to version 1.4.11 or later. Vulnerability management and security teams should also review and update IP-based rate limiting configurations and monitor audit logs for potential exploitation attempts.

Technical summary

The getClientIP() function in Bulwark Webmail's lib/admin/session.ts file was vulnerable to IP address spoofing. An attacker could manipulate the X-Forwarded-For header to bypass IP-based rate limiting or forge audit log entries. This vulnerability has been fixed in version 1.4.11. Affected systems should prioritize upgrading to this version or later. Technical details are based on CVE and NVD data.

Defensive priority

High

Recommended defensive actions

  • Upgrade to Bulwark Webmail version 1.4.11 or later
  • Review and update IP-based rate limiting configurations
  • Monitor for suspicious activity in audit logs
  • Review compensating controls for exposed systems while remediation is scheduled and verified
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record was published on 2026-04-06T21:16:20.867Z and last modified on 2026-07-24T21:10:00.143Z. The NVD entry is currently Analyzed. Evidence is limited to CVE and NVD information. Defenders should verify system configurations and review logs for potential exploitation attempts within the known affected scope.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-35391 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-35391

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-35391 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-35391

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.