---
id: "CVE-2026-113728"
kind: "vulnerability"
aliases: ["CVE-2026-113728"]
title: "Bulwark Webmail: DNS rebinding lets unauthenticated requests reach internal services"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["internet-facing", "package", "self-hosted", "stalwart-mail", "webmail"]
not_affected_if: ["managed-hosting", "version-1.9.2-or-later"]
published_at: "2026-10-20T22:19:29+00:00"
first_seen_at: "2026-10-23T21:57:25+00:00"
updated_at: "2026-10-25T03:18:55+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-113728", "first_seen_at": "2026-10-23T21:57:25+00:00"}]
---

# Bulwark Webmail: DNS rebinding lets unauthenticated requests reach internal services

Bulwark Webmail's unauthenticated /api/fetch-ical endpoint checks a hostname with one DNS lookup, then fetches it with a second lookup, so an attacker's DNS can point the second lookup at loopback, private, or cloud metadata addresses. The attacker gets up to 10 MB of the internal HTTP or HTTPS response returned to them.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Bulwark Webmail version and confirm whether it is below `1.9.2`.
- Confirm whether the instance exposes `POST /api/fetch-ical` to the internet.
- unknown for other checks, the sources do not say.

## Fix

- Upgrade Bulwark Webmail to `1.9.2` or later.
- unknown for interim mitigations, the sources do not say.

## Timeline

- 2026-10-23T21:57:25+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-113728

## From the sources

Bulwark Webmail is a self-hosted webmail client for Stalwart Mail Server. Prior to 1.9.2, the unauthenticated POST /api/fetch-ical endpoint validates a caller-supplied hostname with one DNS lookup and then passes the URL to fetch, which performs a separate lookup for the socket connection. An attacker controlling authoritative DNS can return a public address during validation and then rebind the hostname to a loopback, private, link-local, or cloud metadata address for the connection, causing the server to return up to 10 MB of an internal HTTP or HTTPS response. The same check-then-fetch pattern also existed in authenticated JMAP login and TOTP token-exchange flows. This issue is fixed in version 1.9.2.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_