Bulwark Webmail is a self-hosted webmail client for Stalwart Mail Server.

Code

The project this record applies to. Exploit listings stay in References.

• Repository · github.com

Timeline

Detection, updates, and resolution for this record.

1. Apr 2, 2026 · NIST NVD

   Detected

   Bulwark Webmail is a self-hosted webmail client for Stalwart Mail Server. Prior to version 1.4.10, the GET /api/auth/session endpoint previously included the user's plaintext password in the JSON response. This exposed credentials to browser logs, local caches, and network proxie. This issue has been patched in version 1.4.10.

2. Jul 24, 2026 · NIST NVD

   Updated

   Bulwark Webmail is a self-hosted webmail client for Stalwart Mail Server. Prior to version 1.4.10, the GET /api/auth/session endpoint previously included the user's plaintext password in the JSON response. This exposed credentials to browser logs, local caches, and network proxie. This issue has been patched in version 1.4.10.

Affected

• cpe bulwarkmail/webmailversion unspecified

Sources

• CVE.orgVulnerability recordCVE-2026-34833

  Official CVE identifier

  cve.org
• NIST NVDVulnerability recordCVE-2026-34833

  Bulwark Webmail is a self-hosted webmail client for Stalwart Mail Server. Prior to version 1.4.10, the GET /api/auth/session endpoint previously included the user's plaintext password in the JSON response. This exposed credentials to browser logs, local caches, and network proxie

  nvd.nist.gov

References

• Product · github.com
• Vendor Advisory · github.com