Remote Code Execution Vulnerability in Vaultwarden, A Bitwarden-Compatible Server
CVE-2026-116678

5.8MEDIUM

Key Information:

Vendor

Dani-garcia

Status
Vaultwarden
Vendor
CVE Published:
27 October 2026

What is CVE-2026-116678?

Vaultwarden, a server compatible with Bitwarden, has a vulnerability in its icon downloading mechanism prior to version 1.37.0. The flaw arises when the server incorrectly processes favicon URLs that are under the control of an attacker, allowing potential access to internal or loopback addresses. This undermines prior security measures and could lead to exposure of confidential internal responses, which may contain sensitive data. To mitigate this risk, users must upgrade to version 1.37.0 or later.

Affected Version(s)

vaultwarden < 1.37.0

References

https://github.com/dani-garcia/vaultwarden/security/advis...
x_refsource_CONFIRM
https://github.com/dani-garcia/vaultwarden/pull/7472
x_refsource_MISC
https://github.com/dani-garcia/vaultwarden/commit/46ae59e...
x_refsource_MISC

CVSS V3.1

Score:
5.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.