SSRF in Bulwarkmail Webmail
CVE-2026-113728
Bulwark Webmail is a self-hosted webmail client for Stalwart Mail Server. Prior to 1.9.2, the unauthenticated POST /api/fetch-ical endpoint validates a caller-supplied hostname with one DNS lookup and then passes the URL to fetch, which performs a separate lookup for the socket connection. An attacker controlling authoritative DNS can return a public address during validation and then rebind the hostname to a loopback, private, link-local, or cloud metadata address for the connection, causing the server to return up to 10 MB of an internal HTTP or HTTPS response. The same check-then-fetch pattern also existed in authenticated JMAP login and TOTP token-exchange flows. This issue is fixed in version 1.9.2.
Vulnerability class: SSRF (Server-Side Request Forgery)
Published .
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.
EPSS exploit prediction
No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.
Affected products
- Bulwarkmail Webmail — versions < 1.9.2
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2026-113728?
- CVE-2026-113728 is a high-severity vulnerability in Bulwarkmail Webmail, classified under Server-Side Request Forgery (SSRF). CVSS score: 7.5/10. Published 2026-10-20.
- How severe is CVE-2026-113728?
- High severity. CVSS v3 base score is 7.5 out of 10.