CVE-2026-35389

Bulwark Webmail is a self-hosted webmail client for Stalwart Mail Server. Prior to 1.4.11, S/MIME signature verification did not validate the certificate trust chain (checkChain: false). Any email signed with a self-signed or untrusted certificate was displayed as having a valid signature. This vulnerability is fixed in 1.4.11.

• CWE-295

• https://github.com/bulwarkmail/webmail/security/advisories/GHSA-v6w6-338p-p256Vendor Advisory

Published

Apr 6, 2026

Last Modified

Jul 24, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-35382Rejected reason: Voluntarily withdrawn
• CVE-2026-35383Bentley Systems iTwin Platform exposed a Cesium ion access t…6.9
• CVE-2026-35385In OpenSSH before 10.3, a file downloaded by scp may be inst…8.1
• CVE-2026-35386In OpenSSH before 10.3, command execution can occur via shel…8.1
• CVE-2026-35387OpenSSH before 10.3 can use unintended ECDSA algorithms. Lis…6.5
• CVE-2026-35388OpenSSH before 10.3 omits connection multiplexing confirmati…2.5
• CVE-2026-3539Rejected reason: Determined a bug and not a vulnerability
• CVE-2026-35390Bulwark Webmail is a self-hosted webmail client for Stalwart…5.4
• CVE-2026-35391Bulwark Webmail is a self-hosted webmail client for Stalwart…7.5
• CVE-2026-35392goshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-be…9.8
• CVE-2026-35393goshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-be…9.8
• CVE-2026-35394Mobile Next is an MCP server for mobile development and auto…8.8