# CVE-2026-75514: BunkerWeb rDNS spoofing bypass in blacklist/greylist/antibot

Source: https://junglewise.ai/threats/cve-2026-75514-bunkerweb-rdns-spoofing-bypass-in-blacklist-greylist-antibot  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-20. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-75514 · Severity: medium · CVSS 5.9 · Published 2026-08-20

BunkerWeb is an open-source web application firewall that uses reverse DNS (rDNS) lookups to make trust decisions about incoming traffic, such as blocking or rate-limiting requests. An attacker who controls a PTR (reverse DNS) record can spoof a trusted domain suffix to bypass the firewall's blacklist, gain preferential treatment, or skip security challenges, effectively defeating these protective mechanisms.

Technologies: [Bunkerity BunkerWeb](https://junglewise.ai/threats/technologies/bunkerweb). Vendors: [Bunkerity](https://junglewise.ai/threats/vendors/bunkerity).

## Quick answers

**Is CVE-2026-75514 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-75514 being exploited in the wild.

**How severe is CVE-2026-75514?** Medium severity, with a CVSS score of 5.9, published 20 August 2026.

**Which products and versions are affected?** Bunkerity BunkerWeb prior to 1.6.13.

**Is there a fix for CVE-2026-75514?** A patch was published on 2026-07-08: Fix committed; released in version 1.6.13 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-75514 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-75514?** Check whether you run Bunkerity BunkerWeb at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an insufficient validation flaw in the blacklist, greylist, and antibot modules (src/common/core/blacklist/blacklist.lua, src/common/core/greylist/greylist.lua, and src/common/core/antibot/antibot.lua). These modules trust rDNS PTR suffix matches in IGNORE_RDNS, GREYLIST_RDNS, and ANTIBOT_IGNORE_RDNS without performing forward-confirm reverse DNS (FCrDNS) validation to verify that the hostname actually resolves back to the client's IP address. An unauthenticated remote attacker who controls a PTR record can set a malicious PTR to match a trusted suffix (e.g., ".googlebot.com") and bypass security controls. The vulnerability requires no authentication or special network access beyond control of a PTR record. The fix, deployed in version 1.6.13, implements FCrDNS validation to confirm hostname-to-IP mappings before honoring rDNS-based trust decisions.

## Affected products

- Bunkerity BunkerWeb prior to 1.6.13

## Timeline

- 2026-08-20: disclosed
- 2026-07-08: patched: Fix committed; released in version 1.6.13

## References

- [https://github.com/bunkerity/bunkerweb/commit/1a97e5b3f977130a1b84507a9e1f703c8eec12eb](https://github.com/bunkerity/bunkerweb/commit/1a97e5b3f977130a1b84507a9e1f703c8eec12eb)
- [https://github.com/bunkerity/bunkerweb/pull/3710](https://github.com/bunkerity/bunkerweb/pull/3710)

## Related threats

- [Bunkerity BunkerWeb authorization bypass in cache management routes](https://junglewise.ai/threats/cve-2026-61718-bunkerity-bunkerweb-authorization-bypass-in-cache-management)
- [Bunkerity BunkerWeb privilege escalation in UI and API](https://junglewise.ai/threats/cve-2026-54728-bunkerity-bunkerweb-privilege-escalation-in-ui-and-api)