Vaultwarden 1.37.4: 7 security fixes, clean Docker upgrade

released
lab run
upgraded from
1.37.3
guest
Ubuntu 26.04 VM
tested
yes, in our lab

Summary

Vaultwarden 1.37.4 is mainly a security release. The release notes list seven advisories: one High (organization member revocation, CVSS 8.1), five Medium and one Low. They cover two-factor authentication, organization invitations, attachments, event logs, cipher sharing and the organization API key. The details are private for now, pending CVE assignment. The maintainers “strongly advise updating as soon as possible.”

It also updates dependencies, adds some feature flags for newer Bitwarden clients, and removes a few old endpoints and settings.

Breaking changes and deprecations

All of this comes from the release notes (“reported”, not tested by us unless stated in the next section):

  • Reverse proxies: with IP_HEADER=X-Forwarded-For, the client IP is now the rightmost address not listed in IP_HEADER_TRUSTED_PROXIES (it used to be the leftmost). If you chain several proxies (for example a CDN in front of nginx), add all of them to IP_HEADER_TRUSTED_PROXIES. Otherwise the proxy’s address is used for rate limiting and logs.
  • Sends: bw send receive on CLI 2026.4.2 and older no longer works. Creating and managing Sends works on all clients.
  • Feature flags removed: ssh-agent, ssh-key-vault-item, mutual-tls, anon-addy-self-host-alias, simple-login-self-host-alias, pm-25373-windows-biometrics-v2, pm-26340-linux-biometrics-v2, desktop-ui-migration-milestone-1 to -4, cxp-import-mobile and cxp-export-mobile. If EXPERIMENTAL_CLIENT_FEATURE_FLAGS still lists one, startup logs a warning and saving settings in the admin panel fails until you remove it.
  • Duo: DUO_USE_IFRAME is removed and ignored if set.
  • Removed endpoints: the legacy POST /identity/accounts/register and POST /api/accounts/prelogin. The notes say no current client uses them.
  • New email template: email/recover_twofactor, sent after a login with a two-step recovery code (matters if you customize templates).
  • MariaDB/MySQL on the Alpine image: if your database server has no native TLS, the connection might fail. Set MARIADB_TLS_DISABLE_PEER_VERIFICATION=1.
  • Organization API key: if you don’t fully trust your organization’s Admins, the notes suggest rotating the key after updating (Admin Console → Settings → Rotate API key), because Admins could view it before this release.

Tested in our lab

We tested a Docker upgrade from 1.37.3 to 1.37.4 on a fresh Ubuntu VM.

  • Installed 1.37.3 with docker run and a /vw-data bind mount, as in the project’s docs. It started and /api/alive answered.
  • Created a user through the admin panel invite, so there was data in the database.
  • Stopped the container cleanly, removed it, pulled 1.37.4 and started it on the same data directory.
  • After the upgrade: /api/alive answered, the web vault returned HTTP 200, the admin panel still listed the user, and the binary reported Vaultwarden 1.37.4. The startup log had no warnings or errors.
  • POST /api/accounts/prelogin now returns 404, as the release notes say.

What we did not test: real client logins, organizations, attachments, two-factor, reverse proxy IP handling, MariaDB/MySQL/PostgreSQL backends, or the security fixes themselves. The lab used the default SQLite database and no email.

Lab log

$ sudo docker run -d --name vaultwarden -v /vw-data/:/data/ [...] -p 8080:80 vaultwarden/server:1.37.3
$ curl -s localhost:8080/api/alive
"2026-10-31T19:24:13.812128Z"
$ curl -s -b /tmp/c -X POST localhost:8080/admin/invite -H "Content-Type: application/json" -d "{\"email\":\"lab@example.com\"}"
{"_status":1,[...]"email":"lab@example.com",[...]}
$ sudo docker stop vaultwarden && sudo docker rm vaultwarden
$ sudo docker pull -q vaultwarden/server:1.37.4
docker.io/vaultwarden/server:1.37.4
$ sudo docker run -d --name vaultwarden -v /vw-data/:/data/ [...] -p 8080:80 vaultwarden/server:1.37.4
$ curl -s localhost:8080/api/alive
"2026-10-31T19:24:43.469135Z"
$ curl -s -o /dev/null -w "web %{http_code}\n" localhost:8080/
web 200
$ curl -s -b /tmp/c localhost:8080/admin/users | grep -o "lab@example.com" | head -1
lab@example.com
$ sudo docker logs vaultwarden 2>&1 | grep -E "Rocket|ERROR|WARN"
[2026-10-31 19:24:33.500][start][INFO] Rocket has launched from http://0.0.0.0:80
$ sudo docker exec vaultwarden /vaultwarden --version
Vaultwarden 1.37.4
Web-Vault 2026.7.0
$ curl -s -o /dev/null -w "prelogin %{http_code}\n" -X POST localhost:8080/api/accounts/prelogin [...]
prelogin 404

Reported by others

We did not look for community reports for this release. The release notes link a discussion thread.

Verdict

Upgrade soon. The release fixes seven security advisories, including a High one about revoked organization members, and the Docker upgrade from 1.37.3 was uneventful in our lab. Before you update, check two things: if you run more than one reverse proxy, add them all to IP_HEADER_TRUSTED_PROXIES, and remove any removed feature flags from EXPERIMENTAL_CLIENT_FEATURE_FLAGS. Back up your data directory first, as always.

sources