CVE-2026-47160

Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to 1.36.0, Vaultwarden's /icons/{domain}/icon.png endpoint used src/http_client.rs checks including should_block_address() and post_resolve() that missed decimal, hexadecimal, and octal IP representations, allowing SSRF through the icon-fetching HTTP client for blind internal network or port discovery. This issue is fixed in version 1.36.0.

• CWE-918
• CWE-1389

• https://github.com/dani-garcia/vaultwarden/commit/a354e57659d26149fde0d91b76f83fce94e8f277
• https://github.com/dani-garcia/vaultwarden/pull/7162
• https://github.com/dani-garcia/vaultwarden/releases/tag/1.36.0
• https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-72vh-x5jq-m82g
• https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-72vh-x5jq-m82g

Published

Jul 15, 2026

Last Modified

Jul 15, 2026

Status

Deferred

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-47154In EmberZNet v9.0.2 and earlier, a malformed GetProfileRespo…6.5
• CVE-2026-47155vLLM is an inference and serving engine for large language m…6.5
• CVE-2026-47157aiograpi is an asynchronous Instagram API for Python. aiogra…6.5
• CVE-2026-47158Vaultwarden is a Bitwarden-compatible server written in Rust…8.3
• CVE-2026-47159Vaultwarden is a Bitwarden-compatible server written in Rust…6.9
• CVE-2026-4716Incorrect boundary conditions, uninitialized memory in the J…9.1
• CVE-2026-47161RELATE is a web-based courseware package. Prior to commit d6…8.7
• CVE-2026-47162Vim is an open source, command line text editor. Prior to ve…8.8
• CVE-2026-47163Quest Bot is an opensource modern Discord Bot built for mode…7.2
• CVE-2026-47164Vaultwarden is a Bitwarden-compatible server written in Rust…7.7
• CVE-2026-47165ImageMagick is free and open-source software used for editin…4.1
• CVE-2026-47166ImageMagick is free and open-source software used for editin…5.7