CVE-2026-35390: Bulwarkmail Webmail XSS Vulnerability

CVE-2026-35390 Overview

Bulwark Webmail, a self-hosted webmail client designed for Stalwart Mail Server, contains a critical security header misconfiguration in versions prior to 1.4.11. The vulnerability exists in the reverse proxy component (proxy.ts), which incorrectly sets the Content-Security-Policy-Report-Only header instead of the enforcing Content-Security-Policy header. This misconfiguration means that cross-site scripting (XSS) attacks are logged but never blocked, leaving users vulnerable to malicious script execution.

Critical Impact

Attackers can inject and execute arbitrary JavaScript in the context of the Bulwark Webmail application through crafted email HTML content, potentially stealing session tokens or performing unauthorized actions on behalf of authenticated users.

Affected Products

• Bulwarkmail Webmail versions prior to 1.4.11
• Self-hosted Bulwark Webmail deployments integrated with Stalwart Mail Server
• Any environment running vulnerable proxy.ts reverse proxy configuration

Discovery Timeline

• 2026-04-06 - CVE CVE-2026-35390 published to NVD
• 2026-04-09 - Last updated in NVD database

Technical Details for CVE-2026-35390

Vulnerability Analysis

This vulnerability (CWE-79: Cross-Site Scripting) stems from a security header misconfiguration in the Bulwark Webmail reverse proxy component. The Content-Security-Policy (CSP) header is a critical browser security mechanism designed to prevent XSS attacks by restricting which scripts can execute on a page. However, the vulnerable versions of Bulwark Webmail use the Content-Security-Policy-Report-Only variant, which only logs policy violations without actually blocking malicious content.

The attack surface is particularly concerning in a webmail context, as email content frequently contains HTML that gets rendered in the user's browser. An attacker can craft a malicious email containing embedded JavaScript, and when the victim views this email, the malicious script executes with full access to the webmail application's context.

Root Cause

The root cause lies in the proxy.ts file within the Bulwark Webmail codebase. During implementation, the developers configured the CSP header with the -Report-Only suffix, which changes the header's behavior from enforcement mode to monitoring-only mode. This configuration error allows any injected scripts to execute while merely generating violation reports rather than preventing the attack.

This type of misconfiguration often occurs during development or debugging phases when teams want to monitor CSP violations without breaking functionality. The issue arises when this non-enforcing configuration is inadvertently deployed to production environments.

Attack Vector

The vulnerability is exploitable over the network without requiring any special privileges. An attacker can exploit this vulnerability through the following attack path:

1. The attacker crafts a malicious email containing embedded JavaScript within the HTML body
2. The malicious email is sent to a victim who uses a vulnerable Bulwark Webmail instance
3. When the victim opens or previews the email, the HTML content is rendered
4. Due to the misconfigured CSP header, the browser executes the injected JavaScript
5. The malicious script can then steal session tokens, access sensitive email content, or perform actions as the authenticated user

The attack requires user interaction (viewing the malicious email) but requires no authentication from the attacker's perspective. Successful exploitation can lead to session hijacking, data theft, and account compromise.

Detection Methods for CVE-2026-35390

Indicators of Compromise

• Unusual CSP violation reports in server logs indicating script injection attempts
• Unexpected outbound network connections from users' browsers during email viewing sessions
• Session tokens appearing in third-party request logs or suspicious external domains
• User reports of unauthorized actions performed on their accounts

Detection Strategies

• Monitor HTTP response headers for the presence of Content-Security-Policy-Report-Only instead of enforcing Content-Security-Policy
• Implement browser-based monitoring for unexpected script execution during email rendering
• Review web server access logs for suspicious patterns indicating session token exfiltration
• Deploy Content Security Policy violation reporting endpoints to detect attempted XSS attacks

Monitoring Recommendations

• Enable and actively monitor CSP violation reporting to identify exploitation attempts
• Implement anomaly detection for unusual JavaScript execution patterns in the webmail interface
• Monitor authentication logs for session token reuse from different IP addresses or user agents
• Configure alerts for suspicious email content patterns that may indicate XSS payload delivery

How to Mitigate CVE-2026-35390

Immediate Actions Required

• Upgrade Bulwark Webmail to version 1.4.11 or later immediately
• Review server configurations to ensure the enforcing Content-Security-Policy header is present
• Audit recent email activity logs for signs of potential XSS exploitation
• Consider temporarily disabling HTML email rendering until the patch is applied

Patch Information

The vulnerability is fixed in Bulwark Webmail version 1.4.11. The patch corrects the header configuration in proxy.ts to use the enforcing Content-Security-Policy header instead of the report-only variant. Organizations should upgrade to this version or later as soon as possible.

For detailed patch information and security advisory, refer to the GitHub Security Advisory GHSA-6q52-98cr-qx65.

Workarounds

• Configure a reverse proxy (nginx, Apache) in front of Bulwark Webmail to inject a proper enforcing Content-Security-Policy header
• Implement email content sanitization at the mail server level to strip potentially malicious scripts before delivery
• Disable HTML email rendering and force plain-text display until the patch can be applied
• Deploy web application firewall (WAF) rules to detect and block common XSS patterns in email content

# Example nginx configuration to add enforcing CSP header
# Add to your server block configuration
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; frame-ancestors 'none';" always;