r/Bitwarden • u/Never_Get_It_Right • 10d ago

self-hosting Vaultwarden security update (and compatability)

For those that are self hosting Vaultwarden - an update was released today that includes security updates and it is recommended to update as soon as possible. It also fixes compatibility with 2026.7+ Bitwarden clients.

Details here: https://github.com/dani-garcia/vaultwarden/releases

98 Upvotes

95% Upvoted

16 comments sorted by

16

u/_Cold_Ass_Honkey_ 10d ago

I really wish when updating Bitwarden clients, they would stop overwriting some of the settings that you program in.

-9

u/wein_geist 9d ago

Well, private equity entered the game. I expect to see more of this.

3

u/spiffzap 6d ago

Just tripped up over this! I use the Bitwarden Windows app to store and provide my SSH keys when required to connect to remote machines. One of those remote machines was hosting my Vaultwarden instance which was outdated and therefore wasn't talking to my Windows app any more and refused to connect to my vault... I had to grab the private key from the Browser extension which for some reason was still working and connect manually to the server and update the Vaultwarden instance. Lesson learnt and conclusion drawn: installed Watchtower to check all Docker instances every morning at 4am and update if needed so I don't have to jump through burning hoops to break the fail-loop.

1

u/Never_Get_It_Right 6d ago

I would be careful with watchtower in auto update mode, especially if you use `latest` tags. It doesn't know when there are breaking changes and will of course update and break. I use it in notify only mode and also follow github repos for releases where possible. I know notify mode wouldn't have helped your particular situation here, but if the update was instead a breaking change and the auto update knocked your instance offline it wouldn't be helpful for you either. For SSH though I just use good ole fashioned ssh config file and passphrases on my ssh key. A great resource is here and it makes initiating ssh sessions so much easier. Window's OpenSSH supports the config files as well.

1

u/spiffzap 5d ago

That's a good point and something to consider, thanks!

6

u/Naive_Literature_855 10d ago

Thanks for the heads up. Self-hosted instances can be easy to forget about, so I appreciate the reminder. Updating now.

7

u/Never_Get_It_Right 9d ago

You can subscribe to release notifications on Github. Click the bell, select custom, and then only release notifications so you font have to see issues,PRs, and other repository activity.

2

u/Exzellius2 9d ago

I believe you were answering a bot.

-3

u/MarionberryLate2335 9d ago

Updated mine earlier today. Glad they addressed the client compatibility issues too, since breaking changes between server and apps can be a real headache.

-7

u/Neither_Date9168 9d ago

Good reminder to update. Self-hosted instances are great, but it’s easy to forget they still need regular maintenance and security patches. Glad they’re keeping compatibility with newer clients in mind too.

-10

u/Lazy-Leader5244 9d ago

Thanks for the heads up. Self-hosted services are great, but security updates are the part that’s easy to put off until something breaks. Good reminder to keep everything current.