{"id":"CVE-2026-113728","kind":"vulnerability","aliases":["CVE-2026-113728"],"related":[],"title":"Bulwark Webmail: DNS rebinding lets unauthenticated requests reach internal services","description":"Bulwark Webmail is a self-hosted webmail client for Stalwart Mail Server. Prior to 1.9.2, the unauthenticated POST /api/fetch-ical endpoint validates a caller-supplied hostname with one DNS lookup and then passes the URL to fetch, which performs a separate lookup for the socket connection. An attacker controlling authoritative DNS can return a public address during validation and then rebind the hostname to a loopback, private, link-local, or cloud metadata address for the connection, causing the server to return up to 10 MB of an internal HTTP or HTTPS response. The same check-then-fetch pattern also existed in authenticated JMAP login and TOTP token-exchange flows. This issue is fixed in version 1.9.2.","summary":"Bulwark Webmail's unauthenticated /api/fetch-ical endpoint checks a hostname with one DNS lookup, then fetches it with a second lookup, so an attacker's DNS can point the second lookup at loopback, private, or cloud metadata addresses. The attacker gets up to 10 MB of the internal HTTP or HTTPS response returned to them.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["internet-facing","package","self-hosted","stalwart-mail","webmail"],"not_affected_if":["managed-hosting","version-1.9.2-or-later"],"how_to_check":"- Check the installed Bulwark Webmail version and confirm whether it is below `1.9.2`.\n- Confirm whether the instance exposes `POST /api/fetch-ical` to the internet.\n- unknown for other checks, the sources do not say.","fix":"- Upgrade Bulwark Webmail to `1.9.2` or later.\n- unknown for interim mitigations, the sources do not say.","status":"open","published_at":"2026-10-20T22:19:29+00:00","first_seen_at":"2026-10-23T21:57:25+00:00","triaged_at":"2026-10-25T03:18:55+00:00","updated_at":"2026-10-25T03:18:55+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-25T03:18:55Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Bulwark Webmail to `1.9.2` or later.\n- unknown for interim mitigations, the sources do not say.","reach":"internet","title":"Bulwark Webmail: DNS rebinding lets unauthenticated requests reach internal services","impact":"medium","summary":"Bulwark Webmail's unauthenticated /api/fetch-ical endpoint checks a hostname with one DNS lookup, then fetches it with a second lookup, so an attacker's DNS can point the second lookup at loopback, private, or cloud metadata addresses. The attacker gets up to 10 MB of the internal HTTP or HTTPS response returned to them.","category":"package","nicknames":[],"who_cares":["self-hosted","stalwart-mail","webmail","internet-facing"],"confidence":0.8,"needs_auth":"no","worst_case":"Attacker reads internal HTTP responses, including cloud metadata, up to 10 MB","analyst_note":"","how_to_check":"- Check the installed Bulwark Webmail version and confirm whether it is below `1.9.2`.\n- Confirm whether the instance exposes `POST /api/fetch-ical` to the internet.\n- unknown for other checks, the sources do not say.","needs_analyst":false,"not_affected_if":["managed-hosting","version-1.9.2-or-later"],"who_is_affected":"Teams that self-host Bulwark Webmail as a front end for a Stalwart Mail Server are exposed when the instance is reachable from the internet and runs a version before 1.9.2. Because the flaw is in the unauthenticated iCal fetch endpoint, a login is not required. The sources also say the same check-then-fetch pattern existed in authenticated JMAP login and TOTP flows, so those paths are affected too in versions before 1.9.2.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000679,"input_tokens":3462,"output_tokens":665,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-113728':13A,16A '-2026':12A,15A '/api/fetch-ical':32B,99C '1.9.2':95C,199C '10':70B,165C 'address':64B,136C,154C 'also':181C 'attack':50B,66B,128C 'authent':184C 'authorit':130C 'bulwark':1A,28B,80C 'caller':104C 'caller-suppli':103C 'caus':158C 'check':34B,177C 'check-then-fetch':176C 'client':88C 'cloud':62B,152C 'connect':126C,157C 'control':129C 'cve':11A,14A 'dns':3A,39B,52B,109C,131C 'endpoint':33B,100C 'exchang':191C 'exist':182C 'face':19B 'fetch':42B,117C,179C 'fix':196C 'flow':192C 'get':67B 'host':23B,86C 'hostnam':36B,106C,143C 'http':75B,170C 'https':77B,172C 'intern':9A,74B,169C 'internet':18B 'internet-fac':17B 'issu':194C 'jmap':185C 'let':5A 'link':149C 'link-loc':148C 'local':150C 'login':186C 'lookup':40B,47B,57B,110C,122C 'loopback':59B,146C 'mail':26B,91C 'mb':71B,166C 'metadata':63B,153C 'one':38B,108C 'packag':20B 'pass':113C 'pattern':180C 'perform':119C 'point':54B 'post':98C 'prior':93C 'privat':60B,147C 'public':135C 'reach':8A 'rebind':4A,141C 'request':7A 'respons':78B,173C 'return':79B,133C,162C 'second':46B,56B 'self':22B,85C 'self-host':21B,84C 'separ':121C 'server':92C,160C 'servic':10A 'socket':125C 'stalwart':25B,90C 'stalwart-mail':24B 'suppli':105C 'token':190C 'token-exchang':189C 'totp':188C 'unauthent':6A,31B,97C 'url':115C 'valid':101C,138C 'version':198C 'webmail':2A,27B,29B,81C,87C","nicknames":[],"mitigations":[],"who_affected":"Teams that self-host Bulwark Webmail as a front end for a Stalwart Mail Server are exposed when the instance is reachable from the internet and runs a version before 1.9.2. Because the flaw is in the unauthenticated iCal fetch endpoint, a login is not required. The sources also say the same check-then-fetch pattern existed in authenticated JMAP login and TOTP flows, so those paths are affected too in versions before 1.9.2.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:19:29+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113728","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113728","severity":null,"published_at":"2026-10-20T22:19:29+00:00","modified_at":"2026-10-22T16:47:38+00:00","first_seen_at":"2026-10-23T21:57:25+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}