Rpi os Debian 1:6.12.75-1+rpt1~bookworm (2026-03-11)
Clients
Web Vault, CLI, Desktop, Browser Extension, Android, iOS
Client Version
No response
Steps To Reproduce
Use the docker image of this repo
Expected Result
Not be compromised
Actual Result
Not knowing if I am compromised
Logs
Screenshots or Videos
No response
Additional Context
I'm creating an issue to get a response as fast as possible, a post in discussions could easily be missed.
I have very little knowledge about any of this, and trying to search for files and code on github seems not to be reliable at the moment, so with the supply chain attack on bitwarden cli, should I be worried?
(I tried searching for bw1.js and bw_setup.js but github returned nothing, and searching in workflows seems to be disabled on github)
I saw there are multiple security issues on the security tab, me reading those is similar to me reading something in marsian, I can not interpret any of it or if any of them are actually related to this.
Are there any precautions I should take?
How do I know if I have been affected?
I saw there were updates on the docker release, I updated my container today, am I safe?
Thank you for providing this repo. I am not blaming anybody here if the supply chain attack was affecting this repo.
Originally created by @UnconnectedBedna on GitHub (Apr 28, 2026).
Original GitHub issue: https://github.com/dani-garcia/vaultwarden/issues/7158
### Prerequisites
- [x] I have searched the existing **Closed _AND_ Open** [Issues](https://github.com/dani-garcia/vaultwarden/issues?q=is%3Aissue%20) **_AND_** [Discussions](https://github.com/dani-garcia/vaultwarden/discussions?discussions_q=)
- [x] I have searched and read the [documentation](https://github.com/dani-garcia/vaultwarden/wiki/)
### Vaultwarden Support String
### Your environment (Generated via diagnostics page)
* Vaultwarden version: v1.35.8
* Web-vault version: v2026.3.1
* OS/Arch: linux/aarch64
* Running within a container: true (Base: Debian)
* Database type: SQLite
* Database version: 3.51.1
* Uses config.json: true
* Uses a reverse proxy: false
* Internet access: true
* Internet access via a proxy: false
* DNS Check: true
* Browser/Server Time Check: true
* Server/NTP Time Check: true
* Domain Configuration Check: false
* HTTPS Check: true
* Websocket Check: true
* HTTP Response Checks: true
### Config & Details (Generated via diagnostics page)
<details><summary>Show Config & Details</summary>
**Environment settings which are overridden:** SIGNUPS_ALLOWED, ADMIN_TOKEN
**Config:**
```json
{
"_duo_akey": null,
"_enable_duo": true,
"_enable_email_2fa": false,
"_enable_smtp": true,
"_enable_yubico": true,
"_icon_service_csp": "",
"_icon_service_url": "",
"_ip_header_enabled": true,
"_max_note_size": 10000,
"_smtp_img_src": "***:",
"admin_ratelimit_max_burst": 3,
"admin_ratelimit_seconds": 300,
"admin_session_lifetime": 20,
"admin_token": "***",
"allowed_connect_src": "",
"allowed_iframe_ancestors": "",
"attachments_folder": "data/attachments",
"auth_request_purge_schedule": "30 * * * * *",
"authenticator_disable_time_drift": false,
"data_folder": "data",
"database_conn_init": "",
"database_idle_timeout": 600,
"database_max_conns": 10,
"database_min_conns": 2,
"database_timeout": 30,
"database_url": "***************",
"db_connection_retries": 15,
"disable_2fa_remember": false,
"disable_admin_token": false,
"disable_icon_download": false,
"dns_prefer_ipv6": false,
"domain": "*****://**************",
"domain_origin": "*****://**************",
"domain_path": "",
"domain_set": true,
"duo_context_purge_schedule": "30 * * * * *",
"duo_host": null,
"duo_ikey": null,
"duo_skey": null,
"duo_use_iframe": false,
"email_2fa_auto_fallback": false,
"email_2fa_enforce_on_verified_invite": false,
"email_attempts_limit": 3,
"email_change_allowed": true,
"email_expiration_time": 600,
"email_token_size": 6,
"emergency_access_allowed": true,
"emergency_notification_reminder_schedule": "0 3 * * * *",
"emergency_request_timeout_schedule": "0 7 * * * *",
"enable_db_wal": true,
"enable_websocket": true,
"enforce_single_org_with_reset_pw_policy": false,
"event_cleanup_schedule": "0 10 0 * * *",
"events_days_retain": null,
"experimental_client_feature_flags": "",
"extended_logging": true,
"helo_name": null,
"hibp_api_key": null,
"http_request_block_non_global_ips": true,
"http_request_block_regex": null,
"icon_blacklist_non_global_ips": true,
"icon_blacklist_regex": null,
"icon_cache_folder": "data/icon_cache",
"icon_cache_negttl": 259200,
"icon_cache_ttl": 2592000,
"icon_download_timeout": 10,
"icon_redirect_code": 302,
"icon_service": "internal",
"incomplete_2fa_schedule": "30 * * * * *",
"incomplete_2fa_time_limit": 3,
"increase_note_size_limit": false,
"invitation_expiration_hours": 120,
"invitation_org_name": "Vaultwarden",
"invitations_allowed": true,
"ip_header": "X-Real-IP",
"job_poll_interval_ms": 30000,
"log_file": null,
"log_level": "info",
"log_timestamp_format": "%Y-%m-%d %H:%M:%S.%3f",
"login_ratelimit_max_burst": 10,
"login_ratelimit_seconds": 60,
"org_attachment_limit": null,
"org_creation_users": "",
"org_events_enabled": false,
"org_groups_enabled": false,
"password_hints_allowed": true,
"password_iterations": 600000,
"purge_incomplete_sso_auth": "0 20 0 * * *",
"push_enabled": false,
"push_identity_uri": "https://identity.bitwarden.com",
"push_installation_id": "***",
"push_installation_key": "***",
"push_relay_uri": "https://push.bitwarden.com",
"reload_templates": false,
"require_device_email": false,
"rsa_key_filename": "data/rsa_key",
"send_purge_schedule": "0 5 * * * *",
"sendmail_command": null,
"sends_allowed": true,
"sends_folder": "data/sends",
"show_password_hint": false,
"signups_allowed": false,
"signups_domains_whitelist": "",
"signups_verify": false,
"signups_verify_resend_limit": 6,
"signups_verify_resend_time": 3600,
"smtp_accept_invalid_certs": false,
"smtp_accept_invalid_hostnames": false,
"smtp_auth_mechanism": null,
"smtp_debug": false,
"smtp_embed_images": true,
"smtp_explicit_tls": null,
"smtp_from": "*******************",
"smtp_from_name": "***********",
"smtp_host": "**************",
"smtp_password": "***",
"smtp_port": 465,
"smtp_security": "force_tls",
"smtp_ssl": null,
"smtp_timeout": 15,
"smtp_username": "*******************",
"sso_allow_unknown_email_verification": false,
"sso_audience_trusted": null,
"sso_auth_only_not_session": false,
"sso_authority": "",
"sso_authorize_extra_params": "",
"sso_callback_path": "*****://*******************************************",
"sso_client_cache_expiration": 0,
"sso_client_id": "",
"sso_client_secret": "***",
"sso_debug_tokens": false,
"sso_enabled": false,
"sso_master_password_policy": null,
"sso_only": false,
"sso_pkce": true,
"sso_scopes": "email profile",
"sso_signups_match_email": true,
"templates_folder": "data/templates",
"tmp_folder": "data/tmp",
"trash_auto_delete_days": null,
"trash_purge_schedule": "0 5 0 * * *",
"use_sendmail": false,
"use_syslog": false,
"user_attachment_limit": null,
"user_send_limit": null,
"web_vault_enabled": true,
"web_vault_folder": "web-vault/",
"yubico_client_id": null,
"yubico_secret_key": null,
"yubico_server": null
}
```
</details>
### Vaultwarden Build Version
v1.35.8
### Deployment method
Official Container Image
### Custom deployment method
_No response_
### Reverse Proxy
nginx 2.14.0
### Host/Server Operating System
Linux
### Operating System Version
Rpi os Debian 1:6.12.75-1+rpt1~bookworm (2026-03-11)
### Clients
Web Vault, CLI, Desktop, Browser Extension, Android, iOS
### Client Version
_No response_
### Steps To Reproduce
Use the docker image of this repo
### Expected Result
Not be compromised
### Actual Result
Not knowing if I am compromised
### Logs
```text
```
### Screenshots or Videos
_No response_
### Additional Context
I'm creating an issue to get a response as fast as possible, a post in discussions could easily be missed.
I have very little knowledge about any of this, and trying to search for files and code on github seems not to be reliable at the moment, so with the supply chain attack on bitwarden cli, should I be worried?
(I tried searching for `bw1.js` and `bw_setup.js` but github returned nothing, and searching in workflows seems to be disabled on github)
I saw there are multiple security issues on the security tab, me reading those is similar to me reading something in marsian, I can not interpret any of it or if any of them are actually related to this.
Are there any precautions I should take?
How do I know if I have been affected?
I saw there were updates on the docker release, I updated my container today, am I safe?
https://www.endorlabs.com/learn/shai-hulud-the-third-coming----inside-the-bitwarden-cli-2026-4-0-supply-chain-attack
https://www.youtube.com/watch?v=-_TWFbw8XjU
Thank you for providing this repo. I am not blaming anybody here if the supply chain attack was affecting this repo.
GiteaMirror
added the bug label 2026-07-17 20:11:58 -05:00
<!-- gh-comment-id:4338831598 -->
@stefan0xC commented on GitHub (Apr 28, 2026):
Vaultwarden has not been affected. Cf. https://github.com/dani-garcia/vaultwarden/discussions/7126
@UnconnectedBedna commented on GitHub (Apr 28, 2026):
Thank you, both for the extremely fast reply and for providing this repo!
I'm sorry I created this issue even though an issue was already created, I looked too fast in closed (I was in panic mode an my dyslexia probably blocked me from seeing it), and searching using github is clearly not working. :(
<!-- gh-comment-id:4338859161 -->
@UnconnectedBedna commented on GitHub (Apr 28, 2026):
Thank you, both for the extremely fast reply and for providing this repo!
I'm sorry I created this issue even though an issue was already created, I looked too fast in closed (I was in panic mode an my dyslexia probably blocked me from seeing it), and searching using github is clearly not working. :(
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Originally created by @UnconnectedBedna on GitHub (Apr 28, 2026).
Original GitHub issue: https://github.com/dani-garcia/vaultwarden/issues/7158
Prerequisites
Vaultwarden Support String
Your environment (Generated via diagnostics page)
Config & Details (Generated via diagnostics page)
Show Config & Details
Environment settings which are overridden: SIGNUPS_ALLOWED, ADMIN_TOKEN
Config:
Vaultwarden Build Version
v1.35.8
Deployment method
Official Container Image
Custom deployment method
No response
Reverse Proxy
nginx 2.14.0
Host/Server Operating System
Linux
Operating System Version
Rpi os Debian 1:6.12.75-1+rpt1~bookworm (2026-03-11)
Clients
Web Vault, CLI, Desktop, Browser Extension, Android, iOS
Client Version
No response
Steps To Reproduce
Use the docker image of this repo
Expected Result
Not be compromised
Actual Result
Not knowing if I am compromised
Logs
Screenshots or Videos
No response
Additional Context
I'm creating an issue to get a response as fast as possible, a post in discussions could easily be missed.
I have very little knowledge about any of this, and trying to search for files and code on github seems not to be reliable at the moment, so with the supply chain attack on bitwarden cli, should I be worried?
(I tried searching for
bw1.jsandbw_setup.jsbut github returned nothing, and searching in workflows seems to be disabled on github)I saw there are multiple security issues on the security tab, me reading those is similar to me reading something in marsian, I can not interpret any of it or if any of them are actually related to this.
Are there any precautions I should take?
How do I know if I have been affected?
I saw there were updates on the docker release, I updated my container today, am I safe?
https://www.endorlabs.com/learn/shai-hulud-the-third-coming----inside-the-bitwarden-cli-2026-4-0-supply-chain-attack
https://www.youtube.com/watch?v=-_TWFbw8XjU
Thank you for providing this repo. I am not blaming anybody here if the supply chain attack was affecting this repo.
@stefan0xC commented on GitHub (Apr 28, 2026):
Vaultwarden has not been affected. Cf. https://github.com/dani-garcia/vaultwarden/discussions/7126
@UnconnectedBedna commented on GitHub (Apr 28, 2026):
Thank you, both for the extremely fast reply and for providing this repo!
I'm sorry I created this issue even though an issue was already created, I looked too fast in closed (I was in panic mode an my dyslexia probably blocked me from seeing it), and searching using github is clearly not working. :(