{
 "slug": "vaultwarden",
 "name": "Vaultwarden",
 "tagline": "Bitwarden-compatible password manager server",
 "category": "security-identity",
 "use_cases": [
  "password-manager",
  "bitwarden-compatible",
  "password-sharing"
 ],
 "aliases": [],
 "status": "live",
 "upstream": {
  "vendor": "Daniel Garcia",
  "url": "https://github.com/dani-garcia/vaultwarden",
  "license": "AGPL-3.0",
  "license_url": "https://github.com/dani-garcia/vaultwarden/blob/main/LICENSE.txt"
 },
 "image": {
  "os": "Ubuntu 24.04 LTS",
  "cis_level": 1,
  "ports": [
   80,
   443
  ],
  "artifacts": [
   "/etc/lynxroute/sbom.json",
   "/etc/lynxroute/cis-report.html",
   "/usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md"
  ]
 },
 "clouds": {
  "aws": {
   "status": "live",
   "version": "1.37.4",
   "last_build": "2026-10-23",
   "entity_id": "prod-qj6ftlmz3qu3q",
   "ami_alias": "/aws/service/marketplace/prod-qj6ftlmz3qu3q/latest",
   "listing_url": "https://aws.amazon.com/marketplace/pp/prodview-o3qapxqnon5by",
   "recommended_instance_type": "t3.micro",
   "price_usd_per_hour": 0.03,
   "free_trial_days": 5,
   "unit": "instance-hour"
  },
  "azure": {
   "status": "live",
   "version": "1.37.3",
   "last_build": "2026-09-17",
   "offer_id": "vaultwarden",
   "plan_id": "payg-gen2",
   "image_urn": "lynxroute:vaultwarden:payg-gen2:latest",
   "listing_url": "https://azuremarketplace.microsoft.com/en-us/marketplace/apps/lynxroute.vaultwarden?tab=Overview",
   "recommended_vm_size": "Standard_D2s_v3",
   "price_usd_per_vcpu_hour": 0.028,
   "unit": "vcpu-hour"
  },
  "alicloud": {
   "status": "not_offered"
  }
 },
 "urls": {
  "page": "https://lynxroute.com/products/vaultwarden/",
  "json": "https://lynxroute.com/products/vaultwarden/product.json"
 },
 "release_notes": [
  {
   "version": "1.37.4",
   "title": "Vaultwarden 1.37.4",
   "notes": "* Vaultwarden updated 1.37.3 -> 1.37.4, a security release. AGPL-3.0 unchanged\n* Security: seven advisories fixed, including organization member revocation (GHSA-69q9-v8p6-xvx3, High), a two-factor authentication flaw (GHSA-7jg8-8m5x-6j9r), and attachment, cipher-sharing and organization API key issues\n* Removes the long-deprecated DUO_USE_IFRAME setting and retired client feature flags; this image sets neither\n* Rebuilt on the latest CIS Level 1 hardened Ubuntu 24.04 LTS base, picking up every operating-system security update published since the previous build\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-10-23"
   }
  },
  {
   "version": "1.37.3",
   "title": "Vaultwarden 1.37.3",
   "notes": "* Vaultwarden upgraded to 1.37.3 (from 1.37.2). Security hardening: two-factor \"remember me\" tokens are revoked when the password, KDF or two-factor settings change, and the prelogin and auth-request endpoints are rate limited\n* Fixes master password change with newer web vault releases, organization import without groups, and account registration from iOS clients\n* Adds the SSO_SIGNUPS_ALLOWED setting and a two-factor reset path for organization account recovery\n* HTTPS on by default: self-signed TLS on port 443 (HTTP :80 redirects to HTTPS), with Certbot pre-installed: sudo certbot --nginx -d yourdomain.com\n* Rebuilt on the current CIS Level 1 hardened Ubuntu 24.04 LTS base for the latest Ubuntu security updates\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-09-15",
    "azure": "2026-09-17"
   }
  },
  {
   "version": "1.37.2",
   "title": "Vaultwarden v1.37.2",
   "notes": "* Vaultwarden upgraded to 1.37.2 (from 1.37.1) - required for Bitwarden clients\n  2026.8.0 and later\n* Adds a dummy revisionDate for newer clients, records the user email in\n  successful login logs, and fixes the sendmail executable permission check\n* Carries the 1.37.0 security fixes: SSRF via the icon endpoint,\n  cross-organization cipher access, an organization policy bypass on\n  directory import, a Send access-count bypass, and unauthenticated\n  WebSocket flooding\n* HTTPS on by default: self-signed TLS on port 443 (HTTP :80 redirects to HTTPS)\n* Certbot pre-installed - swap in a trusted cert: sudo certbot --nginx -d yourdomain.com\n* Rebuilt on the latest CIS Level 1 hardened Ubuntu 24.04 LTS base\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-08-23",
    "azure": "2026-09-06"
   }
  },
  {
   "version": "1.37.1",
   "title": "Vaultwarden v1.37.1",
   "notes": "* Vaultwarden upgraded to 1.37.1 (from 1.37.0) - patch release that resolves\n  the organization invite failures introduced in 1.37.0. If you applied a\n  local workaround for those, revert it before upgrading\n* Carries the 1.37.0 security fixes: SSRF via the icon endpoint,\n  cross-organization cipher access, an organization policy bypass on\n  directory import, a Send access-count bypass, and unauthenticated\n  WebSocket flooding\n* Compatible with Bitwarden clients 2026.7.0 and later\n* HTTPS on by default: self-signed TLS on port 443 (HTTP :80 redirects to HTTPS)\n* Certbot pre-installed - swap in a trusted cert: sudo certbot --nginx -d yourdomain.com\n* Rebuilt on the latest CIS Level 1 hardened Ubuntu 24.04 LTS base\n",
   "source": "backfill-git",
   "live": {
    "aws": "2026-08-18",
    "azure": "2026-08-19"
   }
  },
  {
   "version": "1.37.0",
   "title": "Vaultwarden v1.37.0-tls",
   "notes": "* Vaultwarden upgraded to 1.37.0 (from 1.36.0) - fixes eight medium-severity\n  security issues, including SSRF via the icon endpoint, cross-organization\n  cipher access, an organization policy bypass on directory import, a Send\n  access-count bypass, and unauthenticated WebSocket flooding\n* Required for compatibility with Bitwarden clients 2026.7.0 and later; adds\n  support for the 2026.5.0 and 2026.6.0 client protocol changes, a biometrics\n  feature flag for Linux clients, and the SSO_AUTHORIZE_BODY option\n* HTTPS on by default: self-signed TLS on port 443 (HTTP :80 redirects to HTTPS)\n* Certbot pre-installed - swap in a trusted cert: sudo certbot --nginx -d yourdomain.com\n* Rebuilt on the latest CIS Level 1 hardened Ubuntu 24.04 LTS base\n",
   "source": "backfill-git",
   "live": {
    "aws": "2026-07-24",
    "azure": "2026-07-27"
   }
  },
  {
   "version": "1.36.0",
   "title": "Vaultwarden 1.36.0 - May 2026",
   "notes": "* Vaultwarden 1.36.0 on Ubuntu 24.04 LTS\n* Security release - fixes for SSO CSRF, SSRF via icon endpoint,\n  and user/organization enumeration (5 GHSA advisories)\n* New: item archiving support\n* Web Vault updated to v2026.4.1\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-07-01",
    "azure": "2026-06-10"
   }
  },
  {
   "version": "1.35.8",
   "title": "Vaultwarden 1.35.8 - April 2026",
   "notes": "* Vaultwarden 1.35.8 on Ubuntu 24.04 LTS\n* Patch update from 1.35.7\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-04-30"
   }
  },
  {
   "version": "1.35.7",
   "title": "Vaultwarden 1.35.7 - Initial release (April 2026)",
   "notes": "* Vaultwarden 1.35.7 on Ubuntu 24.04 LTS\n* CIS Level 1 hardening, HTTPS at first boot, unique admin token, Certbot pre-installed\n* SBOM, CIS Report, IMDSv2 enforced\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-04-21"
   }
  }
 ],
 "release_history": [
  {
   "version": "1.37.4",
   "aws": "2026-10-23"
  },
  {
   "version": "1.37.3",
   "aws": "2026-09-15",
   "azure": "2026-09-17"
  },
  {
   "version": "1.37.2",
   "aws": "2026-08-23",
   "azure": "2026-09-06"
  },
  {
   "version": "1.37.1",
   "aws": "2026-08-18",
   "azure": "2026-08-19"
  },
  {
   "version": "1.37.0",
   "aws": "2026-07-24",
   "azure": "2026-07-27"
  },
  {
   "version": "1.36.0",
   "aws": "2026-07-01",
   "azure": "2026-06-10"
  },
  {
   "version": "1.35.8",
   "aws": "2026-04-30"
  },
  {
   "version": "1.35.7",
   "aws": "2026-04-21"
  }
 ],
 "deploy": {
  "aws_cli": "# subscribe once on the AWS Marketplace listing, then:\naws ec2 run-instances \\\n  --image-id resolve:ssm:/aws/service/marketplace/prod-qj6ftlmz3qu3q/latest \\\n  --instance-type t3.micro --key-name my-key --security-group-ids sg-xxxxxxxx",
  "azure_cli": "# accept the plan terms once, then:\naz vm image terms accept --publisher lynxroute --offer vaultwarden --plan payg-gen2\naz vm create -g my-rg -n vaultwarden --size Standard_D2s_v3 \\\n  --image lynxroute:vaultwarden:payg-gen2:latest --admin-username azureuser --generate-ssh-keys"
 },
 "description": {
  "what_is": "Vaultwarden is a lightweight self-hosted password manager server written in Rust - an unofficial community reimplementation of the Bitwarden client API. It supports the full Bitwarden self-hosted feature set (vault items, secure notes, attachments, TOTP, FIDO2/U2F, organisations, collections, sends, emergency access, password breach checks) without requiring the full official server stack of MSSQL, Identity Server and multiple .NET microservices. The single Rust binary plus a bundled web vault (Bitwarden's GPL-3.0 web client) serves all official Bitwarden desktop, mobile and browser-extension clients on Windows, macOS, Linux, Android and iOS. Persists vault data and metadata in SQLite by default (PostgreSQL and MySQL optional). AGPL-3.0 license - practical choice for small and medium teams that want a self-hosted vault without the operational footprint of the full Bitwarden server.",
  "image_adds": "Security hardening:\n* HTTPS enabled at first boot with a self-signed certificate\n* Unique admin token generated per instance\n* Certbot pre-installed - replace self-signed cert with Let's Encrypt in one command\n* SQLite database accessible from localhost only\n* UFW firewall - only ports 80, 443, and 22 open\n* fail2ban, AppArmor\n\nOS hardening (CIS Level 1):\n* CIS Ubuntu 24.04 LTS Level 1 benchmark applied via ansible-lockdown\n* auditd, SSH hardening, Kernel hardening, IMDSv2 enforced\n\nCompliance artifacts:\n* SBOM - CycloneDX 1.6 at /etc/lynxroute/sbom.json\n* CIS Conformance Report at /etc/lynxroute/cis-report.html\n* CIS Tailored Profile at /usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md"
 },
 "generated_at": "2026-10-31T09:36:34Z"
}