CVE-2026-54728
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
A vulnerability in BunkerWeb and BunkerWeb PRO prior to versions 1.6.12 and 0.57 allows a low-privileged authenticated user to escalate privileges through improper validation of the Host header in the UI and API. The issue affects a configuration-dependent input processing path.
Risk Assessment
The organization risks compromise of confidentiality, integrity, and availability of the BunkerWeb instance, potentially leading to full control of the WAF and attacks on protected applications.
Recommendation
Immediately upgrade BunkerWeb to version 1.6.12 or later and BunkerWeb PRO to version 0.57 or later.
Other vulnerabilities in BunkerWeb
See all- CVE-2026-75514Medium
BunkerWeb prior to 1.6.13 has a vulnerability in the blacklist, greylist, and antibot modules that trust PTR suffix matches in IGNORE_RDNS, GREYLIST_RDNS, and ANTIBOT_IGNORE_RDNS without using get_ips to confirm that the hostname resolves to the client address. An unauthenticated remote attacker who controls a PTR record can spoof a trusted suffix to bypass rDNS-based blacklisting, gain greylist treatment, or skip an antibot challenge.
- CVE-2026-61718Medium
In BunkerWeb versions 1.6.2 through 1.6.12, the BiscuitMiddleware authorization bypass list included the /cache/ URL prefix, allowing low-privilege read-only accounts to permanently delete job cache files containing blacklist, greylist, DNSBL, CrowdSec, GeoIP, ModSecurity CRS, Let's Encrypt, ACME, and custom configuration data. This issue is fixed in version 1.6.12.
Original NVD description (English source)
bunkerweb is an Open-source and next-generation Web Application Firewall (WAF). Prior to BunkerWeb 1.6.12 and BunkerWeb PRO 0.57, authenticated Host header handling in the BunkerWeb UI and API improperly validated and neutralized user-controlled input in a configuration-dependent path, allowing a low-privileged authenticated user to escalate privileges and affect confidentiality, integrity, and availability of the BunkerWeb instance. This issue is fixed in BunkerWeb version 1.6.12 and BunkerWeb PRO version 0.57.