Skip to content

vaultwarden

v1.37.0 Security

This release includes 9 security fixes for security teams reviewing exposed deployments.

Published 2d Secrets & Credentials
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 9 known CVEs

Topics

bitwarden bitwarden-rs docker rocket rust vaultwarden

Affected surfaces

auth rbac rce_ssrf

Summary

AI summary

Security updates fix SSRF, cross‑organization access, import bypasses, WebSocket flooding, secret sharing, and authorization issues.

Full changelog

Note

This update is required for support with clients with version 2026.7.0+, please update before reporting any issues with them.

Security Fixes

This release contains security fixes for the following advisories. We strongly advice to update as soon as possible.

These are private for now, pending CVE assignment and publishing at a later date.

What's Changed

  • OpenDAL S3 parameter support by @txase in https://github.com/dani-garcia/vaultwarden/pull/6127
  • Fix SSO Cookie path by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/7187
  • fix email 2fa for bw cli by @stefan0xC in https://github.com/dani-garcia/vaultwarden/pull/7225
  • sso_auth improvements by @Timshel in https://github.com/dani-garcia/vaultwarden/pull/7197
  • Reject unrecognised DATABASE_URL instead of silent SQLite fallback by @mfw78 in https://github.com/dani-garcia/vaultwarden/pull/7061
  • Switch to xx-cargo by @dfunkt in https://github.com/dani-garcia/vaultwarden/pull/6640
  • Updates and fixes by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/7235
  • Switch to Edition 2024, more clippy lints, and less macro calls by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/7200
  • Serve Apple app site association file by @user71424q in https://github.com/dani-garcia/vaultwarden/pull/7191
  • Update Rust, Crates and GHA by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/7307
  • Fix enforce blocked by @Timshel in https://github.com/dani-garcia/vaultwarden/pull/7246
  • Admin password recovery endpoint change by @Timshel in https://github.com/dani-garcia/vaultwarden/pull/7270
  • fix(sends): emit hideEmail as non-null boolean in sync response by @kvdb in https://github.com/dani-garcia/vaultwarden/pull/7283
  • Org membership delete remove Invitation by @Timshel in https://github.com/dani-garcia/vaultwarden/pull/7284
  • [v2026.5.0] Registration request update by @Timshel in https://github.com/dani-garcia/vaultwarden/pull/7295
  • [v2026.5.0] PutPolicy now using vnext format by @Timshel in https://github.com/dani-garcia/vaultwarden/pull/7296
  • 2026.6.0 send support by @Timshel in https://github.com/dani-garcia/vaultwarden/pull/7346
  • Add SSO_AUTHORIZE_BODY by @Timshel in https://github.com/dani-garcia/vaultwarden/pull/7357
  • Add pm-26340-linux-biometrics-v2 feature flag by @pilotstew in https://github.com/dani-garcia/vaultwarden/pull/7358
  • improve CI by @TriplEight in https://github.com/dani-garcia/vaultwarden/pull/6991
  • Misc updates and fixes by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/7406
  • Remove old compatibility code by @Timshel in https://github.com/dani-garcia/vaultwarden/pull/7434
  • Fix compilation with newer rust-musl version by @dfunkt in https://github.com/dani-garcia/vaultwarden/pull/7453
  • Fix Custom Role CSS for new dialog markup by @tom27052006 in https://github.com/dani-garcia/vaultwarden/pull/7442
  • Remove unused fields by @Timshel in https://github.com/dani-garcia/vaultwarden/pull/7458
  • Update API response, crates and GHA by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/7470
  • Trusted proxy support, unauthenticated rate limit & other fixes by @dani-garcia in https://github.com/dani-garcia/vaultwarden/pull/7472

New Contributors

  • @mfw78 made their first contribution in https://github.com/dani-garcia/vaultwarden/pull/7061
  • @user71424q made their first contribution in https://github.com/dani-garcia/vaultwarden/pull/7191
  • @kvdb made their first contribution in https://github.com/dani-garcia/vaultwarden/pull/7283
  • @pilotstew made their first contribution in https://github.com/dani-garcia/vaultwarden/pull/7358
  • @TriplEight made their first contribution in https://github.com/dani-garcia/vaultwarden/pull/6991
  • @tom27052006 made their first contribution in https://github.com/dani-garcia/vaultwarden/pull/7442

Full Changelog: https://github.com/dani-garcia/vaultwarden/compare/1.36.0...1.37.0

Breaking Changes

  • Reject unrecognised DATABASE_URL instead of silent SQLite fallback
  • Admin password recovery endpoint change

Security Fixes

  • GHSA-hw4g-2v3f-74x5 – SSRF via the icon endpoint (Medium, CVSS 5.8)
  • GHSA-vh5m-fc9v-m84g – SSRF via the icon endpoint (Medium, CVSS 6.3)
  • GHSA-xwf8-pjh7-h589 – Cross‑Organization Cipher Access (Medium, CVSS 5.9)
  • GHSA-88qc-6ch9-mc3j – Organization Policy Bypass on Directory Import (Medium, CVSS 5.5)
  • GHSA-rxhg-2pw9-vf25 – Send Access‑Count Bypass (Medium, CVSS 5.3)
  • GHSA-96f7-78q5-j345 – Unauthenticated WebSocket Flooding DDOS (Medium, CVSS 5.3)
  • GHSA-455c-vgg9-jxw8 – Cross‑Organization Secret Sharing (Medium, CVSS 4.3)
  • GHSA-f3qw-qg77-hmm4 & GHSA-jq2g-h4xr-4mcr – Organization Import Authorization (Medium, CVSS 4.3)
  • GHSA-rqf8-2568-r7mc – Organization Data Enumeration via Manager role (Medium, CVSS 4.3)
View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track vaultwarden

Get notified when new releases ship.

Sign up free

About vaultwarden

Unofficial Bitwarden compatible server written in Rust, formerly known as bitwarden_rs

All releases →

Related context

Beta — feedback welcome: [email protected]