# CVE-2026-113728: Bulwark Webmail DNS-rebinding SSRF

Source: https://junglewise.ai/threats/cve-2026-113728-bulwark-webmail-is-a-self-hosted-webmail-client-for-stalwart  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-20. Updated: 2026-10-20  
License: CC BY 4.0 with a link back

CVE-2026-113728 · Severity: high · CVSS 7.5 · Published 2026-10-20

Bulwark Webmail is a self-hosted webmail client that integrates with Stalwart Mail Server. Before version 1.9.2, an attacker who controls authoritative DNS for a domain can exploit a time-of-check-time-of-use (TOCTOU) flaw to trick the server into fetching and returning up to 10 MB of content from internal addresses like loopback or cloud metadata services, potentially exposing sensitive internal data.

Vendors: [Bulwark](https://junglewise.ai/threats/vendors/bulwark).

## Quick answers

**Is CVE-2026-113728 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-113728 being exploited in the wild.

**How severe is CVE-2026-113728?** High severity, with a CVSS score of 7.5, published 20 October 2026.

**Which products and versions are affected?** Bulwark Webmail before 1.9.2.

**Is there a fix for CVE-2026-113728?** Yes: fixed in 1.9.2. Until then: Pin the resolved IP address at socket-connect time when fetching caller-supplied URLs; do not rely on a separate DNS lookup before and during the connection phase. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-113728 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-113728?** Check whether you run Bulwark Webmail at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 1.9.2

Pin the resolved IP address at socket-connect time when fetching caller-supplied URLs; do not rely on a separate DNS lookup before and during the connection phase.

## Technical details

The vulnerability is a DNS-rebinding SSRF in the unauthenticated /api/fetch-ical endpoint and authenticated JMAP login and TOTP token-exchange flows. The server validates a caller-supplied hostname via a single DNS lookup, but an attacker controlling authoritative DNS can return a public IP during validation and rebind the hostname to a loopback, RFC-1918, link-local, or cloud-metadata address during the subsequent socket connection. This allows the attacker to read internal HTTP/HTTPS responses.

## Affected products

- Bulwark Webmail before 1.9.2

## Timeline

- 2026-08-26: disclosed
- 2026-10-20: advisory

## References

- [https://github.com/bulwarkmail/webmail/commit/3288589e5248dcc1da769cc578827a9ee1adc941](https://github.com/bulwarkmail/webmail/commit/3288589e5248dcc1da769cc578827a9ee1adc941)
- [https://github.com/bulwarkmail/webmail/releases/tag/1.9.2](https://github.com/bulwarkmail/webmail/releases/tag/1.9.2)