Vaultwarden, a Bitwarden-compatible server written in Rust, had an SSRF vulnerability (CVE-2026-47160) in versions before 1.36.0. The vulnerability is located in the /icons/{domain}/icon.png endpoint where the HTTP client used to fetch icons did not properly block certain IP address formats (decimal, hexadecimal, octal) due to incomplete checks in src/http_client.rs functions should_block_address() and post_resolve(). This flaw allows attackers to craft requests that bypass IP blocking logic and perform SSRF attacks, potentially enabling blind internal network or port discovery. The vulnerability has a CVSS 3.1 base score of 5.8 (medium severity). The issue is resolved in Vaultwarden version 1.36.0.

An attacker can exploit this SSRF vulnerability to make the Vaultwarden server send HTTP requests to internal or otherwise restricted network resources by bypassing IP address blocking checks. This can lead to blind internal network or port discovery, potentially exposing internal infrastructure details. There is no indication of direct data compromise or denial of service from this vulnerability alone.

A fix is available in Vaultwarden version 1.36.0. Users should upgrade to version 1.36.0 or later to remediate this vulnerability. No vendor advisory is provided to indicate alternative mitigations or temporary fixes. Until upgraded, users should be aware of the risk of SSRF via the icon-fetching endpoint.