Threat Intelligence Database

BunkerWeb is an open-source, next-generation Web Application Firewall. Prior to 1.6.13, the blacklist, greylist, and antibot modules in src/common/core/blacklist/blacklist.lua, src/common/core/greylist/greylist.lua, and src/common/core/antibot/antibot.lua trust PTR suffix matches in IGNORE_RDNS, GREYLIST_RDNS, and ANTIBOT_IGNORE_RDNS without using get_ips to confirm that the hostname resolves to the client address. An unauthenticated remote attacker who controls a PTR record can spoof a trusted suffix to bypass rDNS-based blacklisting, gain greylist treatment, or skip an antibot challenge. This issue is fixed in version 1.6.13.

CVE-2026-54728 is a medium severity vulnerability in bunkerity's bunkerweb, an open-source Web Application Firewall. Prior to versions 1.6.12 and 0.57 (PRO), the product improperly validated and neutralized authenticated Host header input in the UI and API. This flaw allows a low-privileged authenticated user to escalate privileges and impact the confidentiality, integrity, and availability of the bunkerweb instance. The issue is fixed in bunkerweb 1.6.12 and bunkerweb PRO 0.57.

bunkerweb versions from 1.6.2 up to but not including 1.6.12 contain an authorization bypass vulnerability in the web UI BiscuitMiddleware. This flaw allowed low-privilege read-only users to delete critical job cache files via the /cache/ URL prefix, which should have been more strictly protected. The issue was fixed in version 1.6.12.