Vaultwarden 1.37.4 Fixes Seven Security Advisories, Including a High-Severity Organization Access Issue

Read this article in French: Vaultwarden 1.37.4 corrige sept failles de sécurité

Vaultwarden, the popular unofficial Rust implementation of the Bitwarden server, has shipped version 1.37.4. The release landed on October 5, 2026, and according to the official GitHub changelog, it closes seven security advisories affecting different parts of the organization and sharing workflow.

If you’re running a self-hosted password manager for a household or a small team, this is one of those updates worth applying promptly rather than queuing for “whenever.” None of the issues are rated Critical, but one of them is rated High, and it touches exactly the kind of access control that self-hosters rely on when they revoke a user from an organization.

The most serious fix: organization member revocation

The headline advisory, GHSA-69q9-v8p6-xvx3, is rated High (8.1). It describes a flaw where a member removed from a Vaultwarden organization could, under certain conditions, retain access to ciphers (the encrypted credential entries) that belonged to that organization. Put plainly: an offboarded teammate, a former collaborator, or anyone whose access you thought you had cut off may have kept a window into shared vault items until this patch landed. CVE identifiers for these advisories had not been assigned at the time of release.

For anyone managing shared vaults across a family or a small business, this is the fix that matters most. If you’ve revoked members from an organization in the past and are concerned about residual access, updating immediately is the right move.

The other six advisories

The remaining six issues are rated Medium or Low, but they’re worth knowing about since several touch day-to-day organization features:

• Two-factor authentication — GHSA-7jg8-8m5x-6j9r — Medium (6.8)
• Organization invitations — GHSA-v576-3wvq-xh3c — Medium (6.8)
• Attachments — GHSA-q5x6-grh5-fqgc — Medium (6.5)
• Organization event logs — GHSA-64mc-4p6f-r7x9 — Medium (4.3)
• Cipher sharing — GHSA-7ccc-c43j-4p36 — Medium (4.3)
• Organization API key — GHSA-qwx4-wcv4-mpcv — Low (3.8)

The last one carries a direct recommendation from the Vaultwarden maintainers: because organization admins could view the organization API key, you should rotate it if you don’t fully trust every admin on your instance. This is done from the Admin Console under Settings, using the “Rotate API key” option.

Behavior changes to watch for

A few non-security changes in 1.37.4 can affect how your instance behaves after upgrading, especially if you sit behind a reverse proxy:

• Client IP detection changed. When IP_HEADER=X-Forwarded-For is set, Vaultwarden now reads the right-most address in the header that is not one of your trusted proxies, instead of the left-most address as before. If you rely on this header for rate-limiting or logging, make sure every proxy in your chain is listed in IP_HEADER_TRUSTED_PROXIES, or client IPs may resolve incorrectly.
• Two legacy endpoints were removed: POST /identity/accounts/register and POST /api/accounts/prelogin. These had already been superseded by newer registration and login flows.
• Several experimental feature flags were dropped (including ssh-agent and mutual-tls support). If your EXPERIMENTAL_CLIENT_FEATURE_FLAGS environment variable still lists a flag that no longer exists, your instance may fail to start. Check that variable before restarting the service.
• bw send receive no longer works with Bitwarden CLI versions 2026.4.2 and earlier. Creating and managing Sends from the CLI is unaffected; only receiving a Send via that specific command requires a newer CLI build.

Should you update now?

One advisory is rated High and concerns access revocation, a control most admins assume just works by default. That alone makes updating to 1.37.4 a reasonable precaution rather than something to put off. As with any Vaultwarden update, back up your data folder (or volume) first, and double-check your trusted proxy configuration if you use IP_HEADER.

This isn’t the first round of security fixes Vaultwarden has shipped this year. We covered a previous security update in version 1.37.0 back in July, which addressed eight separate advisories. The organization and sharing code paths seem to be getting a lot of scrutiny lately, and 1.37.4 is the latest result of that.

For background on the project itself and how it compares to the official server, see our Vaultwarden app page and the Bitwarden app page. The update was also noted by Self-Hosted Weekly in its Week 41 2026 roundup, alongside other self-hosting news from that week.

Full technical details, including the complete diff between versions, are available in the 1.37.4 release notes on GitHub, with the code changes visible in the 1.37.3…1.37.4 comparison.