CVE-2026-47160: Vaultwarden SSRF Vulnerability

CVE-2026-47160 Overview

CVE-2026-47160 is a Server-Side Request Forgery (SSRF) vulnerability [CWE-918] in Vaultwarden, a Bitwarden-compatible server written in Rust. The flaw affects the /icons/{domain}/icon.png endpoint in versions prior to 1.36.0. The should_block_address() and post_resolve() checks in src/http_client.rs failed to normalize decimal, hexadecimal, and octal IP representations. Attackers can abuse the icon-fetching HTTP client to perform blind internal network reconnaissance and port discovery. The issue is fixed in version 1.36.0.

Critical Impact
Unauthenticated attackers can trigger outbound HTTP requests from the Vaultwarden server to internal network addresses, enabling reconnaissance of otherwise unreachable hosts and services.

Affected Products

Vaultwarden versions prior to 1.36.0
Deployments exposing the /icons/{domain}/icon.png endpoint
Self-hosted Bitwarden-compatible instances using vulnerable Vaultwarden builds

Discovery Timeline

2026-07-15 - CVE-2026-47160 published to the National Vulnerability Database (NVD)
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-47160

Vulnerability Analysis

Vaultwarden fetches favicons for saved sites through its /icons/{domain}/icon.png endpoint. Before initiating the outbound HTTP request, the server calls should_block_address() and post_resolve() in src/http_client.rs to reject private and loopback addresses. These checks only validated the canonical dotted-decimal form of IPv4 addresses. Attackers can supply the same address encoded in decimal (http://2130706433/), hexadecimal (http://0x7f000001/), or octal (http://0177.0.0.1/) notation. The parser passes these values through as untrusted hostnames while the underlying resolver still reaches loopback or private ranges. The result is a bypass of the SSRF guard for the icon-fetching client.

Root Cause

The root cause is incomplete input normalization in the IP validation logic. The blocklist assumed the hostname was already parsed into a standard IpAddr structure, but alternative numeric representations reached the downstream HTTP client without being canonicalized first. The IPv4 range checks in src/util.rs also required refinement for reserved ranges such as 192.0.0.0/24.

Attack Vector

Exploitation requires only network access to the Vaultwarden icon endpoint. An attacker requests an icon for a crafted domain whose resolver output or literal encoding points at an internal host. Because the response is a blind fetch, differences in response time and error codes reveal whether the internal target exists and which ports are open. No authentication is required.

rust

// Patch excerpt from src/util.rs - Fix Host/IP resolving (#7162)
std::net::IpAddr::V4(ip) => {
    !(ip.octets()[0] == 0 // "This network"
    || ip.is_private()
    || (ip.octets()[0] == 100 && (ip.octets()[1] & 0b1100_0000 == 0b0100_0000)) // ip.is_shared()
    || ip.is_loopback()
    || ip.is_link_local()
    // addresses reserved for future protocols (`192.0.0.0/24`)
    // .9 and .10 are documented as globally reachable so they're excluded
    || (
        ip.octets()[0] == 192 && ip.octets()[1] == 0 && ip.octets()[2] == 0
        && ip.octets()[3] != 9 && ip.octets()[3] != 10
    )
    || ip.is_documentation()
    || (ip.octets()[0] == 198 && (ip.octets()[1] & 0xfe) == 18) // ip.is_benchmarking()
    || (ip.octets()[0] & 240 == 240 && !ip.is_broadcast()) // ip.is_reserved()
    || ip.is_broadcast())
}

Source: GitHub Commit a354e57

Detection Methods for CVE-2026-47160

Indicators of Compromise

Requests to /icons/{domain}/icon.png where {domain} contains numeric-only, hexadecimal (0x...), or octal-prefixed (0...) IP literals
Outbound connections from the Vaultwarden host targeting RFC1918 ranges, loopback, or link-local addresses shortly after icon endpoint hits
Repeated icon requests to varying hostnames from the same source, consistent with port or host sweeping

Detection Strategies

Parse Vaultwarden access logs for icon endpoint requests and flag hostnames that decode to internal IP ranges after numeric normalization
Correlate ingress requests to /icons/ with outbound egress from the Vaultwarden service to non-public destinations
Deploy web application firewall rules that reject icon domain parameters matching numeric-only or non-standard IP encodings

Monitoring Recommendations

Monitor egress traffic from the Vaultwarden container or host to internal subnets that it should never contact
Alert on anomalous request rates or error-rate spikes on /icons/{domain}/icon.png
Track Vaultwarden version strings across deployments to identify unpatched instances still running builds prior to 1.36.0

How to Mitigate CVE-2026-47160

Immediate Actions Required

Upgrade all Vaultwarden deployments to version 1.36.0 or later
Audit reverse proxy and firewall rules to restrict outbound traffic from the Vaultwarden host to only necessary destinations
Review historical logs for suspicious icon endpoint requests using encoded IP literals

Patch Information

The fix is delivered in Vaultwarden 1.36.0. Details of the change are documented in Pull Request #7162 and the GHSA-72vh-x5jq-m82g security advisory. The patch normalizes IP addresses across decimal, hexadecimal, and octal notations before the SSRF guard evaluates them, and refines reserved-range checks in src/util.rs.

Workarounds

Disable the icon service by setting DISABLE_ICON_DOWNLOAD=true in the Vaultwarden environment configuration until patching is possible
Restrict outbound network access from the Vaultwarden host at the firewall so it cannot reach internal management interfaces or metadata services
Front Vaultwarden with an egress proxy that enforces allowlists for external icon fetch destinations

bash

# Configuration example - disable icon downloads pending upgrade
# docker-compose.yml
services:
  vaultwarden:
    image: vaultwarden/server:1.36.0
    environment:
      - DISABLE_ICON_DOWNLOAD=true
      - ICON_BLACKLIST_NON_GLOBAL_IPS=true