Vaultwarden release notes and updates: what changed in 1.37.x

Latest release: Vaultwarden 1.37.4 (GitHub release, published 2026-10-06 JST). Last checked: 2026-10-29.

The newest Vaultwarden release is 1.37.4, a security release: the maintainers "strongly advise updating as soon as possible".

• Two earlier 1.37 releases were also required for newer Bitwarden clients.
• Updating a Docker install is two commands, as long as your /data folder is on a persistent volume.
• Below is each 1.37.x release in brief, taken from the official GitHub releases page (checked 2026-10-29), followed by the update steps from the Vaultwarden wiki.

1.37.x releases at a glance

1.37.4: security fixes and upgrade notes

The 1.37.4 notes list fixes for advisories covering organization member revocation (rated High, 8.1), two-factor authentication, organization invitations, attachments, organization event logs, cipher sharing and the organization API key. The advisories are private for now, pending CVE assignment.

The release notes also flag three changes to check after updating:

• Reverse proxies: with IP_HEADER=X-Forwarded-For, the client IP is now the rightmost address that isn't in IP_HEADER_TRUSTED_PROXIES (it used to be the leftmost). If you run several proxies in a row, such as a CDN in front of nginx, add all of them to IP_HEADER_TRUSTED_PROXIES.
• Sends: bw send receive on CLI 2026.4.2 and older no longer works. Creating and managing Sends works on all clients.
• Feature flags: several unused flags were removed. If EXPERIMENTAL_CLIENT_FEATURE_FLAGS still lists one, startup logs a warning.

The notes also suggest rotating an organization's API key if it has Admins you don't fully trust (Admin Console → Settings → Rotate API key).

1.37.2 and 1.37.0: client-version requirements

Two releases are tied to Bitwarden client versions.

• 1.37.0 is "required for support with clients with version 2026.7.0+", and 1.37.2 is required for clients 2026.8.0+.
• If an up-to-date Bitwarden app suddenly misbehaves against your server, an outdated Vaultwarden is the first thing to rule out.
• Our common Vaultwarden errors page covers the HTTPS, proxy and volume causes.

How to update Vaultwarden in Docker

The wiki's Updating the vaultwarden image page (checked 2026-10-29) says updating is straightforward as long as you preserve the mounted volume.

Docker Compose:

docker compose pull
docker compose up -d

**Plain docker run** with a bind-mounted data folder: pull the new image, stop and remove the old container, then start a new one with the same -v mount:

docker pull vaultwarden/server:latest
docker stop vaultwarden
docker rm vaultwarden
docker run -d --name vaultwarden -v /vw-data/:/data/ -p 80:80 vaultwarden/server:latest

If you pin a version tag (as our Vaultwarden Docker + HTTPS guide does), change the tag in your compose file to the new release, for example vaultwarden/server:1.37.4, before running pull. Your vault lives in /data. Removing the container without a persistent volume deletes it.

How to follow new releases

• Watch the GitHub releases page: every release has notes, and security releases say so at the top.
• The wiki update page mentions Watchtower as one way to automate image updates.
• Read the upgrade notes before updating if you run a reverse proxy chain or use the admin feature flags.

FAQ

Sources

• Vaultwarden GitHub releases (1.37.0 to 1.37.4): https://github.com/dani-garcia/vaultwarden/releases (checked 2026-10-29)
• Vaultwarden wiki, Updating the vaultwarden image: https://github.com/dani-garcia/vaultwarden/wiki/Updating-the-vaultwarden-image (checked 2026-10-29)

Related guides

• Vaultwarden with Docker + HTTPS (Caddy)
• Common Vaultwarden Errors and How to Fix Them
• Vaultwarden vs Bitwarden Cloud vs Proton Pass: Which Password Manager for a Homelab Household?
• All Vaultwarden pages
• Comparisons
• All guides