Improper input validation in bunkerity bunkerweb
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- High
- Attack requirements
- Present
- Impact type
- —
- Confidentiality · integrity · availability
- Low · High · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA.
Summary
bunkerweb is an Open-source and next-generation Web Application Firewall (WAF). Prior to BunkerWeb 1.6.12 and BunkerWeb PRO 0.57, authenticated Host header handling in the BunkerWeb UI and API improperly validated and neutralized user-controlled input in a configuration-dependent path, allowing a low-privileged authenticated user to escalate privileges and affect confidentiality, integrity, and availability of the BunkerWeb instance. This issue is fixed in BunkerWeb version 1.6.12 and BunkerWeb PRO version 0.57.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
- Fix · CNA bunkerweb (bunkerity) Fixed in 1.6.12
Timeline
- 2026-10-02 Threatist record created from CVE-2026-54728
References
More bunkerity vulnerabilities
- TI-2026-52878 BunkerWeb: rDNS bypass via missing forward-confirmation (FCrDNS) in blacklist, greylist, and antibot CVSS 3.1MEDIUM 5.9
- TI-2026-44177 bunkerweb: Read-only Web UI users can delete job cache files due to missing authorization on /cache/ routes CVSS 3.1MEDIUM 5.4
- TI-2024-35727 Open Redirect Vulnerability in Loading Page in bunkerweb CVSS 4.0MEDIUM 5.1
- TI-2025-07379 Bunker Web 1.6.2 - Uncontrolled external site redirect CVSS 4.0MEDIUM 4.8
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences