PT-2026-29879 · Unknown · Bulwark Webmail+1

Richardweinberger · Published 2026-04-02 · Updated 2026-04-03 · CVE-2026-34833

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Bulwark Webmail versions prior to 1.4.10

Description Bulwark Webmail, a self-hosted webmail client for Stalwart Mail Server, previously included a user's plaintext password in the JSON response when accessing the /api/auth/session endpoint. This exposed credentials to browser logs, local caches, and network proxies.

Recommendations Update Bulwark Webmail to version 1.4.10 or later.

Fix

Cleartext Storage of Sensitive Information

Weakness Enumeration

CWE-312

Related Identifiers

CVE-2026-34833

Affected Products

Bulwark Webmail

Stalwart Mail Server

References · 4

• https://github.com/bulwarkmail/webmail/security/advisories/GHSA-47pm-883h-885r · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-34833 · Security Note
• https://github.com/bulwarkmail/webmail/releases/tag/1.4.10 · Note
• https://twitter.com/CVEnew/status/2040128769877328280 · Twitter Post