CVE-2026-35391: X-Forwarded-For IP Spoofing in Bulwark Webmail

The core of this vulnerability lies in the getClientIP() function within Bulwark Webmail's admin session management. This function incorrectly trusts the leftmost entry of the X-Forwarded-For header, a field that is entirely controlled by the client. An attacker can craft a malicious HTTP request with a forged X-Forwarded-For header, effectively impersonating any IP address they choose. This allows them to bypass IP-based rate limiting mechanisms, enabling repeated attempts to brute-force the administrator login. Furthermore, the forged IP address can be recorded in audit logs, creating a false trail and obscuring the true origin of malicious actions. The blast radius extends to the integrity of the webmail server's audit trails and the security of the administrative interface.

1. Reserved2026-04-02
2. Published2026-04-06
3. Modified2026-04-07
4. EPSS updated2026-04-14

The primary mitigation for CVE-2026-35391 is to immediately upgrade Bulwark Webmail to version 1.4.11 or later. If upgrading is not immediately feasible due to compatibility issues or downtime concerns, consider implementing a Web Application Firewall (WAF) rule to sanitize the X-Forwarded-For header. Specifically, the WAF should be configured to reject requests with excessively long or suspicious X-Forwarded-For headers. Additionally, review and strengthen the rate limiting policies for the admin login, potentially implementing multi-factor authentication to further reduce the risk of brute-force attacks. After upgrading, verify the fix by attempting to send a request with a forged X-Forwarded-For header and confirming that the server correctly rejects it or logs the attempted manipulation.