CVE-2026-91166
mediumWarpgate is an open source SSH, HTTPS and MySQL bastion host for Linux.
Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. From 0.25.0 until 0.27.6, the browser SSH path in warpgate-web-ssh/src/manager.rs handles RCEvent::HostKeyUnknown without the presenting hop identity and instead passes ssh_options.host and ssh_options.port for the final target to KnownHosts::trust. In Prompt and AutoAccept modes, a jump host key can therefore be stored for the target address. A machine later presenting the jump host key at the target address can be accepted as the target, allowing interception of user traffic and a newly issued certificate when certificate authentication is used. The native SSH path is unaffected because it tracks each hop separately. This issue is fixed in version 0.27.6.
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://github.com/warp-tech/warpgate/commit/fb66ff74f979c22054f4d348cc0d9065cc67e5d3 security-advisories@github.com
- https://github.com/warp-tech/warpgate/releases/tag/v0.27.6 security-advisories@github.com
- https://github.com/warp-tech/warpgate/security/advisories/GHSA-w9jj-vpw3-5r8f security-advisories@github.com
- https://github.com/warp-tech/warpgate/security/advisories/GHSA-w9jj-vpw3-5r8f 134c704f-9b21-4f2e-91b3-4a467353bcc0