CVE-2026-47160

Name of the Vulnerable Software and Affected Versions Vaultwarden versions prior to 1.36.0

Description The '/icons/{domain}/icon.png' endpoint uses checks within src/http client.rs, specifically the should block address() and post resolve() functions, which fail to account for decimal, hexadecimal, and octal IP representations. This allows Server-Side Request Forgery (SSRF)—a technique where an attacker induces a server to make requests to an unintended location—through the icon-fetching HTTP client, enabling blind internal network or port discovery.

Recommendations Update to version 1.36.0.