CVE-2026-35389: Bulwarkmail Webmail Disclosure Flaw

CVE-2026-35389 Overview

CVE-2026-35389 is a certificate validation bypass vulnerability in Bulwark Webmail, a self-hosted webmail client designed for Stalwart Mail Server. Prior to version 1.4.11, the S/MIME signature verification implementation failed to validate the certificate trust chain by having the checkChain parameter set to false. This critical oversight allows any email signed with a self-signed or untrusted certificate to be displayed as having a valid signature, effectively undermining the entire S/MIME security model.

Critical Impact

Attackers can forge email signatures using self-signed certificates, causing the webmail interface to display fraudulent emails as legitimately signed, enabling sophisticated phishing and impersonation attacks.

Affected Products

• Bulwarkmail Webmail versions prior to 1.4.11
• Self-hosted deployments using Stalwart Mail Server with Bulwark Webmail client
• Organizations relying on S/MIME signature verification for email authenticity

Discovery Timeline

• 2026-04-06 - CVE CVE-2026-35389 published to NVD
• 2026-04-09 - Last updated in NVD database

Technical Details for CVE-2026-35389

Vulnerability Analysis

This vulnerability falls under CWE-295 (Improper Certificate Validation), a cryptographic vulnerability category that encompasses failures in properly validating SSL/TLS and S/MIME certificates. The flaw exists in how Bulwark Webmail handles S/MIME signature verification for incoming emails.

S/MIME (Secure/Multipurpose Internet Mail Extensions) provides cryptographic security services for email, including digital signatures that verify sender authenticity and message integrity. A properly implemented S/MIME verification process must validate not only the signature itself but also the entire certificate trust chain back to a trusted root Certificate Authority (CA).

In vulnerable versions of Bulwark Webmail, the signature verification routine explicitly bypasses trust chain validation. When an email arrives with an S/MIME signature, the system verifies the cryptographic signature mathematically but fails to check whether the signing certificate is issued by a trusted authority. This means a self-signed certificate created by an attacker will pass verification identically to a legitimate certificate issued by a trusted CA.

Root Cause

The root cause is a misconfigured S/MIME verification implementation where the checkChain parameter was set to false. This configuration explicitly disables the certificate trust chain validation step, which is a fundamental security requirement for any Public Key Infrastructure (PKI) based authentication system.

Without chain validation, the S/MIME implementation only confirms that the signature was created by the private key corresponding to the certificate's public key. It does not verify that the certificate belongs to a legitimate, trusted identity. This completely defeats the purpose of S/MIME signatures, as any attacker can generate their own certificate and sign emails that appear valid.

Attack Vector

This is a network-based attack requiring no authentication or user interaction. An attacker can exploit this vulnerability through the following attack scenario:

The attacker generates a self-signed X.509 certificate with identity information matching a trusted individual or organization (e.g., a company executive or financial institution). Using this fraudulent certificate, the attacker signs a malicious email and sends it to victims using the vulnerable Bulwark Webmail client. When the recipient views the email, Bulwark Webmail displays the signature as valid, lending false credibility to the phishing attempt. The victim, trusting the apparent signature validation, may act on malicious instructions contained in the email.

This attack is particularly dangerous in enterprise environments where S/MIME signatures are used to validate internal communications, financial approvals, or sensitive instructions.

Detection Methods for CVE-2026-35389

Indicators of Compromise

• Emails displaying valid S/MIME signatures from certificates not issued by your organization's trusted Certificate Authorities
• User reports of suspicious emails appearing to have legitimate signatures
• Audit logs showing certificate verification events without corresponding trust chain validation
• Incoming emails with self-signed certificates being marked as verified

Detection Strategies

• Review Bulwark Webmail version to confirm whether it is below 1.4.11
• Audit S/MIME configuration to verify checkChain parameter status
• Monitor email headers for S/MIME signed messages and cross-reference signing certificates against trusted CA lists
• Implement external email gateway scanning to detect self-signed or untrusted certificate signatures before delivery

Monitoring Recommendations

• Enable detailed logging for S/MIME signature verification events in Bulwark Webmail
• Configure alerts for emails signed with certificates not in the organization's trusted certificate store
• Periodically review and validate the list of trusted Certificate Authorities
• Monitor for user complaints about suspicious "verified" emails from unexpected sources

How to Mitigate CVE-2026-35389

Immediate Actions Required

• Upgrade Bulwark Webmail to version 1.4.11 or later immediately
• Audit recent emails with S/MIME signatures for potential compromise
• Alert users about the possibility of fraudulent signed emails received prior to the patch
• Review and validate any sensitive actions taken based on S/MIME-signed emails during the vulnerable period

Patch Information

The vulnerability is fixed in Bulwark Webmail version 1.4.11. Organizations should upgrade to this version or later as soon as possible. The fix properly enables certificate trust chain validation during S/MIME signature verification. For additional details, refer to the GitHub Security Advisory.

Workarounds

• If immediate upgrade is not possible, consider disabling S/MIME signature display features until the patch can be applied
• Implement email gateway solutions that perform independent certificate validation before delivery
• Educate users to manually verify certificate details rather than relying on automated signature validation
• Deploy network-level monitoring to flag emails signed with certificates from untrusted issuers

# Verify current Bulwark Webmail version
# Check your installation and confirm upgrade to 1.4.11+
cat /path/to/bulwark-webmail/package.json | grep version

# After upgrade, verify S/MIME chain validation is enabled
# Consult official documentation for configuration verification