Nginx-based web application firewall
WAF and hardened reverse proxy based on Nginx, with ModSecurity and the OWASP CRS, bot protection and a web UI, for Docker, Kubernetes or Linux.
BunkerWeb puts a security-focused Nginx in front of web services. It enables ModSecurity with the OWASP Core Rule Set, security headers, TLS automation, rate limiting, bad-behaviour bans and bot challenges, configured through environment variables, labels or a web interface.
It integrates with Docker, Swarm, Kubernetes and plain Linux. Bunkerity offers PRO plugins and support on top of the AGPL core.
AGPL-3.0-only · GNU AGPL v3 · Open source
Open core: BunkerWeb's PRO plugins are commercial.
Checked by ThreatWire against the repository's licence file on 2026-10-20. GitHub detects: AGPL-3.0.
16 published advisories for BunkerWeb in GitHub repository advisories; the 12 most recent are listed. Keep the tool updated: security tools often run with broad access.
GHSA-xcv3-gjwr-rwxwhigh2026-09-21
Unauthenticated RCE via the BunkerWeb Worker API in the Official Kubernetes Sidecar Configuration
GHSA-vqvw-37gh-5w49low2026-09-21
Cross-Service Custom Configuration Move via Unauthorized Destination
GHSA-j2mq-vqhg-c5mrmedium2026-09-21
Cache Deletion Crosses the Job-Run Permission Boundary
GHSA-7w87-8gxh-2x99low2026-09-21
Service Conversion Permission Bypass in the Fine-Grained API ACL
GHSA-cvfx-2ffg-cqmjhigh2026-09-21
Bypass filename rules via `filename*=` parameter
GHSA-78p8-cwrf-35r2medium2026-08-24
CI: staging reusable inherits all secrets; 14 reusable workflows lack explicit permissions on release/build paths
GHSA-j63f-j59c-q626medium2026-07-16
TOTP recovery codes can be rotated before second-factor validation
GHSA-cc8g-89qq-j9vmhigh2026-07-16
Authenticated remote code execution via malicious plugin upload — arbitrary Python code executed via SourceFileLoader
GHSA-rwch-jhxx-cx5flow2026-07-16
Improper Hostname Validation Allows Outbound Request Redirection (Potential SSRF) via @ Injection in Instance Registration
GHSA-q54j-5484-pvjmCVE-2026-75514medium2026-07-16
rDNS bypass via missing forward-confirmation (FCrDNS) in blacklist, greylist, whitelist and antibot
GHSA-79fm-4xj6-pp5ghigh2026-07-16
Arbitrary File Write/Delete via Path Traversal in BunkerWeb Let's Encrypt API
GHSA-4wcx-xgv7-fjq8high2026-07-13
Security Vulnerability Report: Path Traversal in UI Plugin Refresh
Sources: GitHub repository advisories · checked 2026-10-20.
Collaborative behaviour-based IPS
Security engine that parses logs to detect aggressive behaviour, blocks it with remediation components and shares signals in a community blocklist.
Web application firewall engine
Cross-platform WAF engine (libmodsecurity) for Apache, Nginx and IIS, typically used with the OWASP Core Rule Set. Now an OWASP project.
ModSecurity-compatible WAF library in Go
OWASP WAF library written in Go, compatible with ModSecurity SecLang rules and the OWASP Core Rule Set, embeddable in Go apps and proxies.
