bunkerweb
v1.6.17🛡️ Open-source and cloud-native Web Application Firewall (WAF)
- Maintenance
- Active389 commits in 3 months · bus factor 1
- License
- AGPL-3.0Copyleft · OSI-approved
- Security
- 17 advisories5 high, 6 medium, 6 low
- Supported versions
- No scheduleendoflife.date does not track this project
11.3k stars · 675 forks · 175 open issues · last release 24 days ago · data checked 49 minutes ago
Security advisories
All advisories on GitHubThe 17 most recent advisories published by the maintainers: 5 high, 6 medium, 6 low. Check the patched version against the one you run.
- lowGHSA-qpp5-c9f6-ph52Nov 9, 2026Web UI Read-Only POST Authorization Uses Path Suffixes
- Affected
- >= 1.6.9-rc2, < 1.6.17-rc2
- Patched in
- 1.6.17-rc2
- highGHSA-xcv3-gjwr-rwxwSep 21, 2026Unauthenticated RCE via the BunkerWeb Worker API in the Official Kubernetes Sidecar Configuration
- Affected
- >= 1.6.6, < 1.6.15; >= 0.0.1, < 1.1.0
- Patched in
- 1.6.15; 1.1.0
- lowGHSA-vqvw-37gh-5w49Sep 21, 2026Cross-Service Custom Configuration Move via Unauthorized Destination
- Affected
- >= 1.6.5, < 1.6.15
- Patched in
- 1.6.15
- mediumGHSA-j2mq-vqhg-c5mrSep 21, 2026Cache Deletion Crosses the Job-Run Permission Boundary
- Affected
- >= 1.6.5, < 1.6.15
- Patched in
- 1.6.15
- lowGHSA-7w87-8gxh-2x99Sep 21, 2026Service Conversion Permission Bypass in the Fine-Grained API ACL
- Affected
- >= 1.6.5, <= 1.6.14
- Patched in
- 1.6.15
- highGHSA-cvfx-2ffg-cqmjSep 21, 2026Bypass filename rules via `filename*=` parameter
- Affected
- >= 1.6.0, <= 1.6.14
- Patched in
- 1.6.15
- mediumGHSA-78p8-cwrf-35r2Aug 24, 2026CI: staging reusable inherits all secrets; 14 reusable workflows lack explicit permissions on release/build paths
- Affected
- 1.6.11
- Patched in
- 1.6.14
- mediumGHSA-j63f-j59c-q626Jul 16, 2026TOTP recovery codes can be rotated before second-factor validation
- Affected
- >= 1.6.0, < 1.6.13
- Patched in
- 1.6.13
- lowGHSA-rwch-jhxx-cx5fJul 16, 2026Improper Hostname Validation Allows Outbound Request Redirection (Potential SSRF) via @ Injection in Instance Registration
- Affected
- < 1.6.13
- Patched in
- 1.6.13
- highGHSA-cc8g-89qq-j9vmJul 16, 2026Authenticated remote code execution via malicious plugin upload — arbitrary Python code executed via SourceFileLoader
- Affected
- >= 1.6.2, < 1.6.13
- Patched in
- 1.6.13
- mediumCVE-2026-75514Jul 16, 2026rDNS bypass via missing forward-confirmation (FCrDNS) in blacklist, greylist, whitelist and antibot
- Affected
- < 1.6.13
- Patched in
- 1.6.13
- highGHSA-79fm-4xj6-pp5gJul 16, 2026Arbitrary File Write/Delete via Path Traversal in BunkerWeb Let's Encrypt API
- Affected
- < 1.6.13
- Patched in
- 1.6.13
- highGHSA-4wcx-xgv7-fjq8Jul 13, 2026Security Vulnerability Report: Path Traversal in UI Plugin Refresh
- Affected
- <= 1.6.9
- Patched in
- 1.6.10
- mediumCVE-2026-54728Jul 8, 2026Authenticated privilege escalation via Host header handling in BunkerWeb UI and API
- Affected
- < 1.6.12; < 0.57
- Patched in
- 1.6.12; 0.57
- mediumCVE-2026-61718Jul 8, 2026Read-only Web UI users can delete job cache files due to missing authorization on /cache/ routes
- Affected
- >= 1.6.2, < 1.6.12
- Patched in
- 1.6.12
- lowCVE-2025-8066Aug 18, 2025CVE-2025-8066 – Open Redirect vulnerability in BunkerWeb UI 1.6.X (< 1.6.4)
- Affected
- < 1.6.4
- Patched in
- 1.6.4
- lowCVE-2024-53264Nov 27, 2024Open Redirect Vulnerability in Loading Page
- Affected
- <=1.5.11
- Patched in
- >1.5.11