PT-2026-29879 · Unknown · Stalwart Mail Server+1

Richardweinberger · CVE-2026-34833 · Published 2026-04-02 · Updated 2026-04-03

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Bulwark Webmail versions prior to 1.4.10

Description Bulwark Webmail, a self-hosted webmail client for Stalwart Mail Server, previously included a user's plaintext password in the JSON response when accessing the /api/auth/session endpoint. This exposed credentials to browser logs, local caches, and network proxies.

Recommendations Update Bulwark Webmail to version 1.4.10 or later.

Exploit

Fix

Cleartext Storage of Sensitive Information

Weakness Enumeration

CWE-312

Related Identifiers

CVE-2026-34833

GHSA-47PM-883H-885R

Affected Products

Bulwark Webmail

Stalwart Mail Server

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34833.json · Exploit
• https://github.com/bulwarkmail/webmail/security/advisories/GHSA-47pm-883h-885r · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-34833 · Security Note
• https://osv.dev/vulnerability/CVE-2026-34833 · Vendor Advisory
• https://github.com/bulwarkmail/webmail/releases/tag/1.4.10 · Note
• https://twitter.com/CVEnew/status/2040128769877328280 · Twitter Post