CVE-2026-75514
MediumCVSS 5.9Exploitation Probability (EPSS)
Low risk38th percentile - higher than 38% of all known CVEs
Summary
BunkerWeb prior to 1.6.13 has a vulnerability in the blacklist, greylist, and antibot modules that trust PTR suffix matches in IGNORE_RDNS, GREYLIST_RDNS, and ANTIBOT_IGNORE_RDNS without using get_ips to confirm that the hostname resolves to the client address. An unauthenticated remote attacker who controls a PTR record can spoof a trusted suffix to bypass rDNS-based blacklisting, gain greylist treatment, or skip an antibot challenge.
Risk Assessment
An attacker can bypass rDNS-based protections, potentially leading to unauthorized access, DDoS attacks, or other malicious activities that should have been blocked.
Recommendation
Upgrade BunkerWeb to version 1.6.13 or later, which includes the fix.
Other vulnerabilities in BunkerWeb
See all- CVE-2026-61718Medium
In BunkerWeb versions 1.6.2 through 1.6.12, the BiscuitMiddleware authorization bypass list included the /cache/ URL prefix, allowing low-privilege read-only accounts to permanently delete job cache files containing blacklist, greylist, DNSBL, CrowdSec, GeoIP, ModSecurity CRS, Let's Encrypt, ACME, and custom configuration data. This issue is fixed in version 1.6.12.
- CVE-2026-54728Medium
A vulnerability in BunkerWeb and BunkerWeb PRO prior to versions 1.6.12 and 0.57 allows a low-privileged authenticated user to escalate privileges through improper validation of the Host header in the UI and API. The issue affects a configuration-dependent input processing path.
Original NVD description (English source)
BunkerWeb is an open-source, next-generation Web Application Firewall. Prior to 1.6.13, the blacklist, greylist, and antibot modules in src/common/core/blacklist/blacklist.lua, src/common/core/greylist/greylist.lua, and src/common/core/antibot/antibot.lua trust PTR suffix matches in IGNORE_RDNS, GREYLIST_RDNS, and ANTIBOT_IGNORE_RDNS without using get_ips to confirm that the hostname resolves to the client address. An unauthenticated remote attacker who controls a PTR record can spoof a trusted suffix to bypass rDNS-based blacklisting, gain greylist treatment, or skip an antibot challenge. This issue is fixed in version 1.6.13.