Vaultwarden, the lightweight Rust-based alternative to the official Bitwarden server, has shipped version 1.37.0. The release landed on July 24, 2026, and it fixes eight distinct security advisories affecting self-hosted Vaultwarden instances, alongside a handful of smaller feature additions.
If you run Vaultwarden, the single-container, Docker-friendly reimplementation of the Bitwarden server that lets you self-host password storage without the full official multi-service stack, this is a release worth applying soon rather than leaving for later.
What’s in the security fixes
According to the official release notes on GitHub, 1.37.0 resolves eight advisories, all currently rated Medium severity, with CVSS scores between 4.3 and 6.3. The advisories are still private pending CVE number assignment, so there are no CVE identifiers yet. The maintainers have published GHSA (GitHub Security Advisory) references instead:
- SSRF via the icon endpoint (GHSA-hw4g-2v3f-74×5, GHSA-vh5m-fc9v-m84g), Medium, 5.8 and 6.3
- Cross-Organization Cipher Access (GHSA-xwf8-pjh7-h589), Medium, 5.9
- Organization Policy Bypass on Directory Import (GHSA-88qc-6ch9-mc3j), Medium, 5.5
- Send Access-Count Bypass (GHSA-rxhg-2pw9-vf25), Medium, 5.3
- Unauthenticated WebSocket Flooding DDoS (GHSA-96f7-78q5-j345), Medium, 5.3
- Cross-Organization Secret Sharing (GHSA-455c-vgg9-jxw8), Medium, 4.3
- Organization Import Authorization (GHSA-f3qw-qg77-hmm4, GHSA-jq2g-h4xr-4mcr), Medium, 4.3
- Organization Data Enumeration via the Manager role (GHSA-rqf8-2568-r7mc), Medium, 4.3
Two of these are worth understanding in plain language. The icon endpoint SSRF issue involves how Vaultwarden fetches website favicons to display next to your saved logins. A crafted icon URL could potentially make your server reach out to internal network addresses it has no business touching, which is the basic pattern behind server-side request forgery. The cross-organization issues (cipher access, secret sharing, data enumeration) all concern the boundary between separate Organizations inside a single Vaultwarden instance. They mainly matter if you use the Organizations feature to share vaults with family or a team: a bug here could let data leak across a boundary meant to keep one organization’s secrets away from another’s.
Two more are easy to explain from their names alone. The Send access-count bypass concerns Vaultwarden’s Send feature, which lets you share a note or file through a link that’s supposed to expire after a set number of views; the bug allowed that limit to be bypassed. The unauthenticated WebSocket flooding issue means someone with no account at all on your server could send enough connection requests at the real-time sync socket to disrupt the service for everyone using it.
None of the eight issues comes with a public proof-of-concept in the release notes, and all are Medium rather than Critical or High. Even so, fixing eight advisories in a single release makes 1.37.0 worth treating as an actual priority, not routine maintenance you can put off.
A client compatibility note
One detail in the release notes is easy to miss: “This update is required for support with clients with version 2026.7.0+.” If you, or anyone using your vault, has updated the official Bitwarden browser extension, desktop app, or mobile app to 2026.7.0 or later, your Vaultwarden server needs to be on 1.37.0 to keep working with it properly.
Other changes in 1.37.0
The rest of the release is smaller: support for OpenDAL-based S3 storage parameters, several improvements to SSO/OIDC authentication flows, a change that makes Vaultwarden reject an unrecognized DATABASE_URL instead of silently falling back to SQLite, trusted-proxy support with unauthenticated rate limiting, and a move to Rust Edition 2024 under the hood. None of this changes day-to-day usage, but it’s useful to know if you’re troubleshooting a deployment after upgrading.
Updating
Updating Vaultwarden means pulling the new image tag and recreating the container. There’s no in-place binary update to run. On Docker Compose, that’s docker compose pull followed by docker compose up -d for the vaultwarden service. Back up your data directory first, as with any update touching authentication and cipher-access code.
For background on how Vaultwarden compares to the official Bitwarden self-hosted stack or a local-only option like KeePassXC, see our comparison guide. Full technical details and the changelog for 1.37.0 are on the GitHub releases page.