Bitwarden CLI v2026.10.1 releases with security hardening and performance improvements

Bitwarden has released version 2026.10.1 of its Command Line Interface (CLI), focusing heavily on security maintenance and internal refactoring. This update addresses several potential vulnerabilities related to data parsing and resource management, making the tool more resilient against malicious input during imports.

In addition to security patches, the release includes performance instrumentation for unlock and sync operations. The update also streamlines the codebase by removing legacy decryption methods and deprecated feature flags, while updating several internal SDK dependencies.

Security hardening and technical refactoring

• Security Mitigations: The release implements an XXE (XML External Entity) guard and resolves polynomial Regular Expression Denial of Service (ReDoS) vulnerabilities in the Enpass and Chrome CSV importers.
• Performance Instrumentation: New performance measurements have been added to the unlock and synchronization workflows to facilitate better debugging and optimization.
• Codebase Cleanup: Developers removed legacy Cipher.decrypt and domain decryption methods, and transitioned the login strategies to a strict TypeScript refactor.
• Resource Management: The update addresses unbounded Key Derivation Function (KDF) parameters and improves the handling of bulk decryption failures in collections.
• CI/CD Enhancements: The continuous integration pipeline now runs Rust advisories outside the lint gate and enforces blocking Rust linting through the lint gate.

Why it matters

For system administrators and DevOps engineers using Bitwarden CLI for automation, these security patches mitigate risks associated with processing untrusted credential exports. The performance measurements and SDK updates provide a more stable and observable foundation for integrating Bitwarden into automated workflows and shell environments.