Is CVE-2026-61718 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-61718 being exploited in the wild.

How severe is CVE-2026-61718?

Medium severity, with a CVSS score of 5.4, published 16 July 2026.

Which products and versions are affected?

Bunkerity BunkerWeb 1.6.2 - 1.6.11.

Is there a fix for CVE-2026-61718?

A patch was published on 2026-06-12: Fix committed to repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-61718 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-61718?

Check whether you run Bunkerity BunkerWeb at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-61718: Bunkerity BunkerWeb authorization bypass in cache management routes

CVE-2026-61718 · Severity: medium · CVSS 5.4 · Published 2026-07-16

BunkerWeb, an open-source web application firewall (WAF), contains a security flaw in its management interface. The vulnerability allows users with restricted, read-only access to bypass security controls and delete critical system cache files. An attacker with low-level credentials could use this to remove security rules, IP blacklists, and configuration data, potentially weakening the firewall's protection and disrupting service availability.

Technologies: Bunkerity BunkerWeb. Vendors: Bunkerity.

Quick answers

Is CVE-2026-61718 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-61718 being exploited in the wild.
How severe is CVE-2026-61718?: Medium severity, with a CVSS score of 5.4, published 16 July 2026.
Which products and versions are affected?: Bunkerity BunkerWeb 1.6.2 - 1.6.11.
Is there a fix for CVE-2026-61718?: A patch was published on 2026-06-12: Fix committed to repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-61718 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-61718?: Check whether you run Bunkerity BunkerWeb at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An authorization bypass exists in the BunkerWeb web UI's BiscuitMiddleware. The middleware's bypass list incorrectly included the '/cache/' URL prefix, causing requests to routes in 'src/ui/app/routes/cache.py' to skip permission checks. While these routes were protected by a '@login_required' decorator, they lacked specific role-based access control (RBAC) checks. Consequently, an authenticated user with only 'reader' (read-only) privileges could successfully execute a 'POST /cache/delete' request. This allows the permanent deletion of job cache files containing sensitive data such as DNSBLs, GeoIP databases, ModSecurity CRS rules, and ACME/Let's Encrypt material. The issue is resolved in version 1.6.12 by removing the prefix from the bypass list and enforcing proper authorization.

Affected products

Bunkerity BunkerWeb 1.6.2 - 1.6.11

Timeline

2026-06-12: patched: Fix committed to repository
2026-07-02: advisory: Version 1.6.12 released
2026-07-08: disclosed: GitHub Security Advisory published
2026-07-16: advisory: NVD record published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.