Vulnerability-Lookup

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

Full-Text Search

Vendor

Product

Assigner (CNA or root)

Sources

Sort by

Order

CVSS min

CVSS max

Apply ordering (override relevance)

CVE-2026-91167 (GCVE-0-2026-91167)

Vulnerability from nvd – Published: 2026-09-21 18:54 – Updated: 2026-09-22 15:40

Title

Warpgate: Missing authorization check on `PUT /users/:id/roles/:role_id` allows any admin to bypass the `AccessRolesAssign` permission boundary

Summary

Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.28.4, PUT /@warpgate/admin/api/users/:id/roles/:role_id reaches api_update_user_role in warpgate-admin/src/api/users.rs through AdminContext but does not require AdminPermission::AccessRolesAssign. A limited administrator with any permission can update expires_at on an existing UserRoleAssignment and clear revoked_at, extending an expiring grant or reinstating a revoked grant. The endpoint cannot create a role assignment that never existed because it returns not found without a matching user and role pair. This issue is fixed in version 0.28.4.

Severity

6 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-22 14:12 UTC

CWE

CWE-862 - Missing Authorization

Assigner

GitHub_M mitre root

References

3 references

URL	Tags
https://github.com/warp-tech/warpgate/security/ad…	x_refsource_CONFIRM
https://github.com/warp-tech/warpgate/commit/c020…	x_refsource_MISC
https://github.com/warp-tech/warpgate/releases/ta…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
warp-tech	warpgate	Affected: < 0.28.4

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-91167",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-22T14:12:28.626585Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-22T15:40:23.360Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "warpgate",
          "vendor": "warp-tech",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.28.4"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.28.4, PUT /@warpgate/admin/api/users/:id/roles/:role_id reaches api_update_user_role in warpgate-admin/src/api/users.rs through AdminContext but does not require AdminPermission::AccessRolesAssign. A limited administrator with any permission can update expires_at on an existing UserRoleAssignment and clear revoked_at, extending an expiring grant or reinstating a revoked grant. The endpoint cannot create a role assignment that never existed because it returns not found without a matching user and role pair. This issue is fixed in version 0.28.4."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 6,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862: Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-21T18:54:38.214Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/warp-tech/warpgate/security/advisories/GHSA-fjgc-484v-j6mf",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/warp-tech/warpgate/security/advisories/GHSA-fjgc-484v-j6mf"
        },
        {
          "name": "https://github.com/warp-tech/warpgate/commit/c020900a9d85989e4280bd03184976bc33e2e61d",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/warp-tech/warpgate/commit/c020900a9d85989e4280bd03184976bc33e2e61d"
        },
        {
          "name": "https://github.com/warp-tech/warpgate/releases/tag/v0.28.4",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/warp-tech/warpgate/releases/tag/v0.28.4"
        }
      ],
      "source": {
        "advisory": "GHSA-fjgc-484v-j6mf",
        "discovery": "UNKNOWN"
      },
      "title": "Warpgate: Missing authorization check on `PUT /users/:id/roles/:role_id` allows any admin to bypass the `AccessRolesAssign` permission boundary"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-91167",
    "datePublished": "2026-09-21T18:54:38.214Z",
    "dateReserved": "2026-09-14T21:20:41.196Z",
    "dateUpdated": "2026-09-22T15:40:23.360Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-91166 (GCVE-0-2026-91166)

Vulnerability from nvd – Published: 2026-09-21 18:53 – Updated: 2026-09-24 22:32

Title

Warpgate: Web SSH stores a jump host's key against the target's address, so it validates as the target

Summary

Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. From 0.25.0 until 0.27.6, the browser SSH path in warpgate-web-ssh/src/manager.rs handles RCEvent::HostKeyUnknown without the presenting hop identity and instead passes ssh_options.host and ssh_options.port for the final target to KnownHosts::trust. In Prompt and AutoAccept modes, a jump host key can therefore be stored for the target address. A machine later presenting the jump host key at the target address can be accepted as the target, allowing interception of user traffic and a newly issued certificate when certificate authentication is used. The native SSH path is unaffected because it tracks each hop separately. This issue is fixed in version 0.27.6.

Severity

5.7 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-24 22:31 UTC

CWE

CWE-297 - Improper Validation of Certificate with Host Mismatch
CWE-923 - Improper Restriction of Communication Channel to Intended Endpoints

Assigner

GitHub_M mitre root

References

3 references

URL	Tags
https://github.com/warp-tech/warpgate/security/ad…	x_refsource_CONFIRM
https://github.com/warp-tech/warpgate/commit/fb66…	x_refsource_MISC
https://github.com/warp-tech/warpgate/releases/ta…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
warp-tech	warpgate	Affected: >= 0.25.0, < 0.27.6

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-91166",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-24T22:31:49.029825Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-24T22:32:09.888Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/warp-tech/warpgate/security/advisories/GHSA-w9jj-vpw3-5r8f"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "warpgate",
          "vendor": "warp-tech",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 0.25.0, \u003c 0.27.6"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. From 0.25.0 until 0.27.6, the browser SSH path in warpgate-web-ssh/src/manager.rs handles RCEvent::HostKeyUnknown without the presenting hop identity and instead passes ssh_options.host and ssh_options.port for the final target to KnownHosts::trust. In Prompt and AutoAccept modes, a jump host key can therefore be stored for the target address. A machine later presenting the jump host key at the target address can be accepted as the target, allowing interception of user traffic and a newly issued certificate when certificate authentication is used. The native SSH path is unaffected because it tracks each hop separately. This issue is fixed in version 0.27.6."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.7,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-297",
              "description": "CWE-297: Improper Validation of Certificate with Host Mismatch",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-923",
              "description": "CWE-923: Improper Restriction of Communication Channel to Intended Endpoints",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-21T18:53:56.224Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/warp-tech/warpgate/security/advisories/GHSA-w9jj-vpw3-5r8f",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/warp-tech/warpgate/security/advisories/GHSA-w9jj-vpw3-5r8f"
        },
        {
          "name": "https://github.com/warp-tech/warpgate/commit/fb66ff74f979c22054f4d348cc0d9065cc67e5d3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/warp-tech/warpgate/commit/fb66ff74f979c22054f4d348cc0d9065cc67e5d3"
        },
        {
          "name": "https://github.com/warp-tech/warpgate/releases/tag/v0.27.6",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/warp-tech/warpgate/releases/tag/v0.27.6"
        }
      ],
      "source": {
        "advisory": "GHSA-w9jj-vpw3-5r8f",
        "discovery": "UNKNOWN"
      },
      "title": "Warpgate: Web SSH stores a jump host\u0027s key against the target\u0027s address, so it validates as the target"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-91166",
    "datePublished": "2026-09-21T18:53:56.224Z",
    "dateReserved": "2026-09-14T21:20:41.196Z",
    "dateUpdated": "2026-09-24T22:32:09.888Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-91165 (GCVE-0-2026-91165)

Vulnerability from nvd – Published: 2026-09-21 18:53 – Updated: 2026-09-21 19:26

Title

Warpgate: Markup injection in SSO form_post return page via unencoded redirect/error values

Summary

Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.27.6, the response_mode=form_post SSO return path in warpgate-protocol-http/src/api/sso_provider_list.rs uses serde_json::to_string inside ReturnToSsoPostResponse without neutralizing a script-closing sequence. The vulnerable value can enter the script block through the attacker-controlled next redirect parameter stored by warpgate-protocol-http/src/api/sso_provider_detail.rs or through IdP-derived error messages that make_redirect_url concatenates without URL encoding. The IdP-derived path is reachable when the attacker controls a configured identity provider, or when the attacker controls the email or username claim on an attacker-controlled account and the configured identity provider permits the required unvalidated claim format. A victim must complete the form_post SSO flow for the injected markup to be rendered. The Warpgate Content-Security-Policy blocks injected JavaScript and event handlers, so the demonstrated impact is content spoofing, a false login form, or a meta refresh rather than script execution. This issue is fixed in version 0.27.6.

Severity

2.4 (Low)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-21 19:26 UTC

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

GitHub_M mitre root

References

3 references

URL	Tags
https://github.com/warp-tech/warpgate/security/ad…	x_refsource_CONFIRM
https://github.com/warp-tech/warpgate/commit/e944…	x_refsource_MISC
https://github.com/warp-tech/warpgate/releases/ta…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
warp-tech	warpgate	Affected: < 0.27.6

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-91165",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-21T19:26:11.810922Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-21T19:26:22.695Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "warpgate",
          "vendor": "warp-tech",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.27.6"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.27.6, the response_mode=form_post SSO return path in warpgate-protocol-http/src/api/sso_provider_list.rs uses serde_json::to_string inside ReturnToSsoPostResponse without neutralizing a script-closing sequence. The vulnerable value can enter the script block through the attacker-controlled next redirect parameter stored by warpgate-protocol-http/src/api/sso_provider_detail.rs or through IdP-derived error messages that make_redirect_url concatenates without URL encoding. The IdP-derived path is reachable when the attacker controls a configured identity provider, or when the attacker controls the email or username claim on an attacker-controlled account and the configured identity provider permits the required unvalidated claim format. A victim must complete the form_post SSO flow for the injected markup to be rendered. The Warpgate Content-Security-Policy blocks injected JavaScript and event handlers, so the demonstrated impact is content spoofing, a false login form, or a meta refresh rather than script execution. This issue is fixed in version 0.27.6."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 2.4,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-21T18:53:03.854Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/warp-tech/warpgate/security/advisories/GHSA-vvpj-p7j8-4rv4",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/warp-tech/warpgate/security/advisories/GHSA-vvpj-p7j8-4rv4"
        },
        {
          "name": "https://github.com/warp-tech/warpgate/commit/e94425a08f501383a67316673749dcbd637c6ce3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/warp-tech/warpgate/commit/e94425a08f501383a67316673749dcbd637c6ce3"
        },
        {
          "name": "https://github.com/warp-tech/warpgate/releases/tag/v0.27.6",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/warp-tech/warpgate/releases/tag/v0.27.6"
        }
      ],
      "source": {
        "advisory": "GHSA-vvpj-p7j8-4rv4",
        "discovery": "UNKNOWN"
      },
      "title": "Warpgate: Markup injection in SSO form_post return page via unencoded redirect/error values"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-91165",
    "datePublished": "2026-09-21T18:53:03.854Z",
    "dateReserved": "2026-09-14T21:20:41.196Z",
    "dateUpdated": "2026-09-21T19:26:22.695Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-91164 (GCVE-0-2026-91164)

Vulnerability from nvd – Published: 2026-09-21 18:50 – Updated: 2026-09-21 19:07

Title

Warpgate: API tokens bypass the user's allowed_ip_ranges restriction

Summary

Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. From 0.23.0 until 0.27.3, HTTP API token authentication resolves ConfigProvider::validate_api_token into RequestAuthorization::UserToken without enforcing the owning user's allowed_ip_ranges against the trusted client address in warpgate-protocol-http/src/common.rs. An attacker holding a leaked, phished, or exfiltrated X-Warpgate-Token can therefore use it from a prohibited network location. Deployments without allowed_ip_ranges are unaffected, and HTTP target proxying plus SSH, MySQL, PostgreSQL, RDP, VNC, and Kubernetes paths do not accept this vulnerable HTTP token flow. This issue is fixed in version 0.27.3.

Severity

4.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-21 19:06 UTC

CWE

CWE-284 - Improper Access Control
CWE-863 - Incorrect Authorization

Assigner

GitHub_M mitre root

References

4 references

URL	Tags
https://github.com/warp-tech/warpgate/security/ad…	x_refsource_CONFIRM
https://github.com/warp-tech/warpgate/pull/2356	x_refsource_MISC
https://github.com/warp-tech/warpgate/commit/8cb3…	x_refsource_MISC
https://github.com/warp-tech/warpgate/releases/ta…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
warp-tech	warpgate	Affected: >= 0.23.0, < 0.27.3

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-91164",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-21T19:06:54.705180Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-21T19:07:48.833Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "warpgate",
          "vendor": "warp-tech",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 0.23.0, \u003c 0.27.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. From 0.23.0 until 0.27.3, HTTP API token authentication resolves ConfigProvider::validate_api_token into RequestAuthorization::UserToken without enforcing the owning user\u0027s allowed_ip_ranges against the trusted client address in warpgate-protocol-http/src/common.rs. An attacker holding a leaked, phished, or exfiltrated X-Warpgate-Token can therefore use it from a prohibited network location. Deployments without allowed_ip_ranges are unaffected, and HTTP target proxying plus SSH, MySQL, PostgreSQL, RDP, VNC, and Kubernetes paths do not accept this vulnerable HTTP token flow. This issue is fixed in version 0.27.3."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-284",
              "description": "CWE-284: Improper Access Control",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863: Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-21T18:50:40.797Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/warp-tech/warpgate/security/advisories/GHSA-qmr2-wp96-h9ff",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/warp-tech/warpgate/security/advisories/GHSA-qmr2-wp96-h9ff"
        },
        {
          "name": "https://github.com/warp-tech/warpgate/pull/2356",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/warp-tech/warpgate/pull/2356"
        },
        {
          "name": "https://github.com/warp-tech/warpgate/commit/8cb33a1a7c447ab0cde3a1ee9f95bf9dde905482",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/warp-tech/warpgate/commit/8cb33a1a7c447ab0cde3a1ee9f95bf9dde905482"
        },
        {
          "name": "https://github.com/warp-tech/warpgate/releases/tag/v0.27.3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/warp-tech/warpgate/releases/tag/v0.27.3"
        }
      ],
      "source": {
        "advisory": "GHSA-qmr2-wp96-h9ff",
        "discovery": "UNKNOWN"
      },
      "title": "Warpgate: API tokens bypass the user\u0027s allowed_ip_ranges restriction"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-91164",
    "datePublished": "2026-09-21T18:50:40.797Z",
    "dateReserved": "2026-09-14T21:20:41.196Z",
    "dateUpdated": "2026-09-21T19:07:48.833Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-63330 (GCVE-0-2026-63330)

Vulnerability from nvd – Published: 2026-09-21 18:49 – Updated: 2026-09-23 19:03

Title

Warpgate: Missing Admin Authorization on Live Recording Stream WebSocket Allows Any Authenticated User to Eavesdrop on Terminal Sessions

Summary

Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.25.6, api_get_recording_stream in warpgate-admin/src/api/recordings_detail.rs protects /@warpgate/admin/api/recordings/{uuid}/stream only with session authentication and omits require_admin_permission for AdminPermission::RecordingsView. Any authenticated regular user who identifies an active recording can subscribe to its WebSocket and receive real-time terminal input and output from proxied SSH, MySQL, or PostgreSQL sessions, including credentials, commands, and other sensitive data belonging to users and administrators. This issue is fixed in version 0.25.6.

Severity

7.7 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-23 19:03 UTC

CWE

CWE-285 - Improper Authorization
CWE-862 - Missing Authorization

Assigner

GitHub_M mitre root

References

3 references

URL	Tags
https://github.com/warp-tech/warpgate/security/ad…	x_refsource_CONFIRM
https://github.com/warp-tech/warpgate/commit/f5cb…	x_refsource_MISC
https://github.com/warp-tech/warpgate/releases/ta…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
warp-tech	warpgate	Affected: < 0.25.6

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-63330",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-23T19:03:05.965475Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-23T19:03:11.343Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/warp-tech/warpgate/security/advisories/GHSA-2q37-6vxr-26jr"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "warpgate",
          "vendor": "warp-tech",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.25.6"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.25.6, api_get_recording_stream in warpgate-admin/src/api/recordings_detail.rs protects /@warpgate/admin/api/recordings/{uuid}/stream only with session authentication and omits require_admin_permission for AdminPermission::RecordingsView. Any authenticated regular user who identifies an active recording can subscribe to its WebSocket and receive real-time terminal input and output from proxied SSH, MySQL, or PostgreSQL sessions, including credentials, commands, and other sensitive data belonging to users and administrators. This issue is fixed in version 0.25.6."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-285",
              "description": "CWE-285: Improper Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862: Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-21T18:49:45.500Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/warp-tech/warpgate/security/advisories/GHSA-2q37-6vxr-26jr",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/warp-tech/warpgate/security/advisories/GHSA-2q37-6vxr-26jr"
        },
        {
          "name": "https://github.com/warp-tech/warpgate/commit/f5cb06ea09065f375870ccee64fe721a2ca79766",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/warp-tech/warpgate/commit/f5cb06ea09065f375870ccee64fe721a2ca79766"
        },
        {
          "name": "https://github.com/warp-tech/warpgate/releases/tag/v0.25.6",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/warp-tech/warpgate/releases/tag/v0.25.6"
        }
      ],
      "source": {
        "advisory": "GHSA-2q37-6vxr-26jr",
        "discovery": "UNKNOWN"
      },
      "title": "Warpgate: Missing Admin Authorization on Live Recording Stream WebSocket Allows Any Authenticated User to Eavesdrop on Terminal Sessions"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-63330",
    "datePublished": "2026-09-21T18:49:45.500Z",
    "dateReserved": "2026-07-16T14:14:24.384Z",
    "dateUpdated": "2026-09-23T19:03:11.343Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-63329 (GCVE-0-2026-63329)

Vulnerability from nvd – Published: 2026-09-21 18:49 – Updated: 2026-09-22 15:40

Title

Warpgate: x-warpgate-username Header Not Stripped from Client Requests Enables Identity Spoofing to WebSocket Backend Targets

Summary

Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.25.6, copy_server_request in warpgate-protocol-http/src/proxy.rs forwards a client-supplied x-warpgate-username header before inject_own_headers appends the authenticated username. Because the request builder preserves repeated values, a proxied backend that trusts the first x-warpgate-username value can authorize an authenticated attacker as another user. The same forwarding policy also accepts the reserved x-warpgate-authentication-type header, and warpgate-common/src/http_headers.rs does not exclude either reserved identity header. This issue is fixed in version 0.25.6.

Severity

4.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-22 14:12 UTC

CWE

CWE-116 - Improper Encoding or Escaping of Output
CWE-290 - Authentication Bypass by Spoofing

Assigner

GitHub_M mitre root

References

3 references

URL	Tags
https://github.com/warp-tech/warpgate/security/ad…	x_refsource_CONFIRM
https://github.com/warp-tech/warpgate/commit/c374…	x_refsource_MISC
https://github.com/warp-tech/warpgate/releases/ta…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
warp-tech	warpgate	Affected: < 0.25.6

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-63329",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-22T14:12:31.220504Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-22T15:40:33.501Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "warpgate",
          "vendor": "warp-tech",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.25.6"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.25.6, copy_server_request in warpgate-protocol-http/src/proxy.rs forwards a client-supplied x-warpgate-username header before inject_own_headers appends the authenticated username. Because the request builder preserves repeated values, a proxied backend that trusts the first x-warpgate-username value can authorize an authenticated attacker as another user. The same forwarding policy also accepts the reserved x-warpgate-authentication-type header, and warpgate-common/src/http_headers.rs does not exclude either reserved identity header. This issue is fixed in version 0.25.6."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-116",
              "description": "CWE-116: Improper Encoding or Escaping of Output",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-290",
              "description": "CWE-290: Authentication Bypass by Spoofing",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-21T18:49:01.603Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/warp-tech/warpgate/security/advisories/GHSA-862h-v6cc-9757",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/warp-tech/warpgate/security/advisories/GHSA-862h-v6cc-9757"
        },
        {
          "name": "https://github.com/warp-tech/warpgate/commit/c3748d7585209781b2d3a39ac9941b91d11d9b77",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/warp-tech/warpgate/commit/c3748d7585209781b2d3a39ac9941b91d11d9b77"
        },
        {
          "name": "https://github.com/warp-tech/warpgate/releases/tag/v0.25.6",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/warp-tech/warpgate/releases/tag/v0.25.6"
        }
      ],
      "source": {
        "advisory": "GHSA-862h-v6cc-9757",
        "discovery": "UNKNOWN"
      },
      "title": "Warpgate: x-warpgate-username Header Not Stripped from Client Requests Enables Identity Spoofing to WebSocket Backend Targets"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-63329",
    "datePublished": "2026-09-21T18:49:01.603Z",
    "dateReserved": "2026-07-16T14:14:24.384Z",
    "dateUpdated": "2026-09-22T15:40:33.501Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-58491 (GCVE-0-2026-58491)

Vulnerability from nvd – Published: 2026-09-21 18:48 – Updated: 2026-09-22 15:40

Title

Warpgate: Reflected XSS in SSO return endpoint via attacker-controlled next parameter

Summary

Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.25.5, the /@warpgate/api/sso/providers/:name/start endpoint stores an attacker-controlled next parameter that the POST /@warpgate/api/sso/return handler inserts without HTML escaping into the response generated by warpgate-protocol-http/src/api/sso_provider_list.rs. A victim who follows a crafted link and completes SSO can cause markup and JavaScript to execute in the authenticated Warpgate origin, allowing access to session data and actions through user APIs, and through administrator APIs only when the victim is an administrator. The GET /@warpgate/api/sso/return path also uses the same unvalidated value as a redirect destination, enabling an open redirect. This issue is fixed in version 0.25.5.

Severity

9.3 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-22 14:20 UTC

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

GitHub_M mitre root

References

3 references

URL	Tags
https://github.com/warp-tech/warpgate/security/ad…	x_refsource_CONFIRM
https://github.com/warp-tech/warpgate/commit/eab0…	x_refsource_MISC
https://github.com/warp-tech/warpgate/releases/ta…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
warp-tech	warpgate	Affected: < 0.25.5

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-58491",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-22T14:20:46.826766Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-22T15:40:39.937Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "warpgate",
          "vendor": "warp-tech",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.25.5"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.25.5, the /@warpgate/api/sso/providers/:name/start endpoint stores an attacker-controlled next parameter that the POST /@warpgate/api/sso/return handler inserts without HTML escaping into the response generated by warpgate-protocol-http/src/api/sso_provider_list.rs. A victim who follows a crafted link and completes SSO can cause markup and JavaScript to execute in the authenticated Warpgate origin, allowing access to session data and actions through user APIs, and through administrator APIs only when the victim is an administrator. The GET /@warpgate/api/sso/return path also uses the same unvalidated value as a redirect destination, enabling an open redirect. This issue is fixed in version 0.25.5."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 9.3,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-21T18:48:03.982Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/warp-tech/warpgate/security/advisories/GHSA-3c3w-75j2-7h74",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/warp-tech/warpgate/security/advisories/GHSA-3c3w-75j2-7h74"
        },
        {
          "name": "https://github.com/warp-tech/warpgate/commit/eab0548f018d95b5f96f8e913527000e05ed93a2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/warp-tech/warpgate/commit/eab0548f018d95b5f96f8e913527000e05ed93a2"
        },
        {
          "name": "https://github.com/warp-tech/warpgate/releases/tag/v0.25.5",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/warp-tech/warpgate/releases/tag/v0.25.5"
        }
      ],
      "source": {
        "advisory": "GHSA-3c3w-75j2-7h74",
        "discovery": "UNKNOWN"
      },
      "title": "Warpgate: Reflected XSS in SSO return endpoint via attacker-controlled next parameter"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-58491",
    "datePublished": "2026-09-21T18:48:03.982Z",
    "dateReserved": "2026-06-30T20:21:25.812Z",
    "dateUpdated": "2026-09-22T15:40:39.937Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-44347 (GCVE-0-2026-44347)

Vulnerability from nvd – Published: 2026-05-12 22:44 – Updated: 2026-05-13 15:36

Title

Warpgate: SSO CSRF -- State Token Not Validated on Return

Summary

Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.23.3, the SSO flow does not validate the state parameter, which makes it possible for an attacker to trick a user into logging into the attacker's account, possibly convincing them to perform sensitive actions on the attacker's account (such as writing sensitive data to the attacker's SSH target, or logging into an HTTP target that the attacker set up). This vulnerability is fixed in 0.23.3.

Severity

5.8 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:H/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-05-13 15:35 UTC

CWE

CWE-352 - Cross-Site Request Forgery (CSRF)

Assigner

GitHub_M mitre root

References

1 reference

URL	Tags
https://github.com/warp-tech/warpgate/security/ad…	x_refsource_CONFIRM

Impacted products

1 product

Vendor	Product	Version
warp-tech	warpgate	Affected: < 0.23.3

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-44347",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-13T15:35:20.915504Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-13T15:36:43.539Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/warp-tech/warpgate/security/advisories/GHSA-rj86-hm3r-c275"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "warpgate",
          "vendor": "warp-tech",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.23.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.23.3, the SSO flow does not validate the state parameter, which makes it possible for an attacker to trick a user into logging into the attacker\u0027s account, possibly convincing them to perform sensitive actions on the attacker\u0027s account (such as writing sensitive data to the attacker\u0027s SSH target, or logging into an HTTP target that the attacker set up). This vulnerability is fixed in 0.23.3."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-352",
              "description": "CWE-352: Cross-Site Request Forgery (CSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-12T22:44:17.831Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/warp-tech/warpgate/security/advisories/GHSA-rj86-hm3r-c275",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/warp-tech/warpgate/security/advisories/GHSA-rj86-hm3r-c275"
        }
      ],
      "source": {
        "advisory": "GHSA-rj86-hm3r-c275",
        "discovery": "UNKNOWN"
      },
      "title": "Warpgate: SSO CSRF -- State Token Not Validated on Return"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-44347",
    "datePublished": "2026-05-12T22:44:17.831Z",
    "dateReserved": "2026-05-05T19:52:59.148Z",
    "dateUpdated": "2026-05-13T15:36:43.539Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2023-48712 (GCVE-0-2023-48712)

Vulnerability from nvd – Published: 2023-11-24 17:02 – Updated: 2024-08-02 21:37

Title

User authorization bug leading to privilege escalation in warpgate

Summary

Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. In affected versions there is a privilege escalation vulnerability through a non-admin user's account. Limited users can impersonate another user's account if only single-factor authentication is configured. If a user knows an admin username, opens the login screen and attempts to authenticate with an incorrect password they can subsequently enter a valid non-admin username and password they will be logged in as the admin user. All installations prior to version 0.9.0 are affected. All users are advised to upgrade. There are no known workarounds for this vulnerability.

Severity

7.1 (High)


                        
                          CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-863 - Incorrect Authorization

Assigner

GitHub_M mitre root

References

2 references

URL	Tags
https://github.com/warp-tech/warpgate/security/ad…	x_refsource_CONFIRM
https://github.com/warp-tech/warpgate/commit/e3b2…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
warp-tech	warpgate	Affected: < 0.9.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T21:37:54.649Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "https://github.com/warp-tech/warpgate/security/advisories/GHSA-c94j-vqr5-3mxr",
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/warp-tech/warpgate/security/advisories/GHSA-c94j-vqr5-3mxr"
          },
          {
            "name": "https://github.com/warp-tech/warpgate/commit/e3b26b2699257b9482dce2e9157bd9b5e05d9c76",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/warp-tech/warpgate/commit/e3b26b2699257b9482dce2e9157bd9b5e05d9c76"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "warpgate",
          "vendor": "warp-tech",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.9.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. In affected versions there is a privilege escalation vulnerability through a non-admin user\u0027s account. Limited users can impersonate another user\u0027s account if only single-factor authentication is configured. If a user knows an admin username, opens the login screen and attempts to authenticate with an incorrect password they can subsequently enter a valid non-admin username and password they will be logged in as the admin user. All installations prior to version 0.9.0 are affected. All users are advised to upgrade. There are no known workarounds for this vulnerability."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863: Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-11-24T17:02:59.929Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/warp-tech/warpgate/security/advisories/GHSA-c94j-vqr5-3mxr",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/warp-tech/warpgate/security/advisories/GHSA-c94j-vqr5-3mxr"
        },
        {
          "name": "https://github.com/warp-tech/warpgate/commit/e3b26b2699257b9482dce2e9157bd9b5e05d9c76",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/warp-tech/warpgate/commit/e3b26b2699257b9482dce2e9157bd9b5e05d9c76"
        }
      ],
      "source": {
        "advisory": "GHSA-c94j-vqr5-3mxr",
        "discovery": "UNKNOWN"
      },
      "title": "User authorization bug leading to privilege escalation in warpgate"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2023-48712",
    "datePublished": "2023-11-24T17:02:59.929Z",
    "dateReserved": "2023-11-17T19:43:37.555Z",
    "dateUpdated": "2024-08-02T21:37:54.649Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-43660 (GCVE-0-2023-43660)

Vulnerability from nvd – Published: 2023-09-27 21:00 – Updated: 2024-09-20 19:34

Title

SSH key password bypassed in warpgate

Summary

Warpgate is a smart SSH, HTTPS and MySQL bastion host for Linux that doesn't need special client apps. The SSH key verification for a user can be bypassed by sending an SSH key offer without a signature. This allows bypassing authentication under following conditions: 1. The attacker knows the username and a valid target name 2. The attacked knows the user's public key and 3. Only SSH public key authentication is required for the user account. This issue has been addressed in version 0.8.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Severity

4.8 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-09-20 17:51 UTC

CWE

CWE-287 - Improper Authentication

Assigner

GitHub_M mitre root

References

2 references

URL	Tags
https://github.com/warp-tech/warpgate/security/ad…	x_refsource_CONFIRM
https://github.com/warp-tech/warpgate/commit/a4df…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
warp-tech	warpgate	Affected: < 0.8.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T19:44:43.825Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "https://github.com/warp-tech/warpgate/security/advisories/GHSA-3cjp-w4cp-m9c8",
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/warp-tech/warpgate/security/advisories/GHSA-3cjp-w4cp-m9c8"
          },
          {
            "name": "https://github.com/warp-tech/warpgate/commit/a4df7f7a21395cfaee7a9789d1e3846290caeb63",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/warp-tech/warpgate/commit/a4df7f7a21395cfaee7a9789d1e3846290caeb63"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-43660",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-20T17:51:05.559514Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-20T19:34:17.363Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "warpgate",
          "vendor": "warp-tech",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.8.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Warpgate is a smart SSH, HTTPS and MySQL bastion host for Linux that doesn\u0027t need special client apps. The SSH key verification for a user can be bypassed by sending an SSH key offer without a signature. This allows bypassing authentication under following conditions: 1. The attacker knows the username and a valid target name 2. The attacked knows the user\u0027s public key and 3. Only SSH public key authentication is required for the user account. This issue has been addressed in version 0.8.1. Users are advised to upgrade. There are no known workarounds for this vulnerability."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-287",
              "description": "CWE-287: Improper Authentication",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-09-27T21:00:29.827Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/warp-tech/warpgate/security/advisories/GHSA-3cjp-w4cp-m9c8",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/warp-tech/warpgate/security/advisories/GHSA-3cjp-w4cp-m9c8"
        },
        {
          "name": "https://github.com/warp-tech/warpgate/commit/a4df7f7a21395cfaee7a9789d1e3846290caeb63",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/warp-tech/warpgate/commit/a4df7f7a21395cfaee7a9789d1e3846290caeb63"
        }
      ],
      "source": {
        "advisory": "GHSA-3cjp-w4cp-m9c8",
        "discovery": "UNKNOWN"
      },
      "title": "SSH key password bypassed in warpgate"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2023-43660",
    "datePublished": "2023-09-27T21:00:29.827Z",
    "dateReserved": "2023-09-20T15:35:38.148Z",
    "dateUpdated": "2024-09-20T19:34:17.363Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-37268 (GCVE-0-2023-37268)

Vulnerability from nvd – Published: 2023-07-14 21:02 – Updated: 2024-10-18 17:41

Title

User login confusion with SSO in warpgate

Summary

Warpgate is an SSH, HTTPS and MySQL bastion host for Linux that doesn't need special client apps. When logging in as a user with SSO enabled an attacker may authenticate as an other user. Any user account which does not have a second factor enabled could be compromised. This issue has been addressed in commit `8173f6512a` and in releases starting with version 0.7.3. Users are advised to upgrade. Users unable to upgrade should require their users to use a second factor in authentication.

Severity

6.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-10-18 17:30 UTC

CWE

CWE-287 - Improper Authentication

Assigner

GitHub_M mitre root

References

2 references

URL	Tags
https://github.com/warp-tech/warpgate/security/ad…	x_refsource_CONFIRM
https://github.com/warp-tech/warpgate/commit/8173…	x_refsource_MISC

Impacted products

2 products

Vendor	Product	Version
warp-tech	warpgate	Affected: < 0.7.3
warpgate_project	warpgate	Affected: 0 , < 0.7.3 (custom) cpe:2.3:a:warpgate_project:warpgate::::::::

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T17:09:33.241Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "https://github.com/warp-tech/warpgate/security/advisories/GHSA-868r-97g5-r9g4",
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/warp-tech/warpgate/security/advisories/GHSA-868r-97g5-r9g4"
          },
          {
            "name": "https://github.com/warp-tech/warpgate/commit/8173f6512ab6183fa5edc5c9a5f3760b8979271e",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/warp-tech/warpgate/commit/8173f6512ab6183fa5edc5c9a5f3760b8979271e"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:warpgate_project:warpgate:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "warpgate",
            "vendor": "warpgate_project",
            "versions": [
              {
                "lessThan": "0.7.3",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-37268",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-18T17:30:49.816727Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-18T17:41:24.928Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "warpgate",
          "vendor": "warp-tech",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.7.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Warpgate is an SSH, HTTPS and MySQL bastion host for Linux that doesn\u0027t need special client apps. When logging in as a user with SSO enabled an attacker may authenticate as an other user. Any user account which does not have a second factor enabled could be compromised. This issue has been addressed in commit `8173f6512a` and in releases starting with version 0.7.3. Users are advised to upgrade. Users unable to upgrade should require their users to use a second factor in authentication."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-287",
              "description": "CWE-287: Improper Authentication",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-07-14T21:02:00.786Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/warp-tech/warpgate/security/advisories/GHSA-868r-97g5-r9g4",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/warp-tech/warpgate/security/advisories/GHSA-868r-97g5-r9g4"
        },
        {
          "name": "https://github.com/warp-tech/warpgate/commit/8173f6512ab6183fa5edc5c9a5f3760b8979271e",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/warp-tech/warpgate/commit/8173f6512ab6183fa5edc5c9a5f3760b8979271e"
        }
      ],
      "source": {
        "advisory": "GHSA-868r-97g5-r9g4",
        "discovery": "UNKNOWN"
      },
      "title": "User login confusion with SSO in warpgate"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2023-37268",
    "datePublished": "2023-07-14T21:02:00.786Z",
    "dateReserved": "2023-06-29T19:35:26.438Z",
    "dateUpdated": "2024-10-18T17:41:24.928Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-28113 (GCVE-0-2023-28113)

Vulnerability from nvd – Published: 2023-03-16 00:00 – Updated: 2025-02-25 14:55

Title

russh may use insecure Diffie-Hellman keys

Summary

russh is a Rust SSH client and server library. Starting in version 0.34.0 and prior to versions 0.36.2 and 0.37.1, Diffie-Hellman key validation is insufficient, which can lead to insecure shared secrets and therefore breaks confidentiality. Connections between a russh client and server or those of a russh peer with some other misbehaving peer are most likely to be problematic. These may vulnerable to eavesdropping. Most other implementations reject such keys, so this is mainly an interoperability issue in such a case. This issue is fixed in versions 0.36.2 and 0.37.1

Severity

5.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-02-25 14:29 UTC

CWE

CWE-20 - Improper Input Validation
CWE-358 - Improperly Implemented Security Check for Standard

Assigner

GitHub_M mitre root

References

6 references

URL	Tags
https://github.com/warp-tech/russh/commit/d831a37…
https://github.com/warp-tech/russh/blob/master/ru…
https://github.com/warp-tech/russh/blob/master/ru…
https://github.com/warp-tech/russh/releases/tag/v0.36.2
https://github.com/warp-tech/russh/releases/tag/v0.37.1
https://github.com/warp-tech/russh/security/advis…

Impacted products

1 product

Vendor	Product	Version
warp-tech	russh	Affected: 0.34.0 , < 0.34.0* (custom) Affected: 0.36.2 , < 0.36.2 (custom) Affected: 0.37.0 , < 0.37.0* (custom) Affected: 0.37.1 , < 0.37.1 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T12:30:24.345Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/warp-tech/russh/commit/d831a3716d3719dc76f091fcea9d94bd4ef97c6e"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/warp-tech/russh/blob/master/russh/src/kex/dh/groups.rs#L72-L76"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/warp-tech/russh/blob/master/russh/src/kex/dh/groups.rs#L78-L81"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/warp-tech/russh/releases/tag/v0.36.2"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/warp-tech/russh/releases/tag/v0.37.1"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/warp-tech/russh/security/advisories/GHSA-cqvm-j2r2-hwpg"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-28113",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-25T14:29:28.461323Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-02-25T14:55:51.611Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "russh",
          "vendor": "warp-tech",
          "versions": [
            {
              "lessThan": "0.34.0*",
              "status": "affected",
              "version": "0.34.0",
              "versionType": "custom"
            },
            {
              "lessThan": "0.36.2",
              "status": "affected",
              "version": "0.36.2",
              "versionType": "custom"
            },
            {
              "lessThan": "0.37.0*",
              "status": "affected",
              "version": "0.37.0",
              "versionType": "custom"
            },
            {
              "lessThan": "0.37.1",
              "status": "affected",
              "version": "0.37.1",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "russh is a Rust SSH client and server library. Starting in version 0.34.0 and prior to versions 0.36.2 and 0.37.1, Diffie-Hellman key validation is insufficient, which can lead to insecure shared secrets and therefore breaks confidentiality. Connections between a russh client and server or those of a russh peer with some other misbehaving peer are most likely to be problematic. These may vulnerable to eavesdropping. Most other implementations reject such keys, so this is mainly an interoperability issue in such a case. This issue is fixed in versions 0.36.2 and 0.37.1"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20 Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-358",
              "description": "CWE-358 Improperly Implemented Security Check for Standard",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-03-16T00:00:00.000Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "url": "https://github.com/warp-tech/russh/commit/d831a3716d3719dc76f091fcea9d94bd4ef97c6e"
        },
        {
          "url": "https://github.com/warp-tech/russh/blob/master/russh/src/kex/dh/groups.rs#L72-L76"
        },
        {
          "url": "https://github.com/warp-tech/russh/blob/master/russh/src/kex/dh/groups.rs#L78-L81"
        },
        {
          "url": "https://github.com/warp-tech/russh/releases/tag/v0.36.2"
        },
        {
          "url": "https://github.com/warp-tech/russh/releases/tag/v0.37.1"
        },
        {
          "url": "https://github.com/warp-tech/russh/security/advisories/GHSA-cqvm-j2r2-hwpg"
        }
      ],
      "source": {
        "advisory": "GHSA-cqvm-j2r2-hwpg",
        "defect": [
          "GHSA-cqvm-j2r2-hwpg"
        ],
        "discovery": "UNKNOWN"
      },
      "title": "russh may use insecure Diffie-Hellman keys",
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2023-28113",
    "datePublished": "2023-03-16T00:00:00.000Z",
    "dateReserved": "2023-03-10T00:00:00.000Z",
    "dateUpdated": "2025-02-25T14:55:51.611Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2026-91167 (GCVE-0-2026-91167)

Vulnerability from cvelistv5 – Published: 2026-09-21 18:54 – Updated: 2026-09-22 15:40

Title

Warpgate: Missing authorization check on `PUT /users/:id/roles/:role_id` allows any admin to bypass the `AccessRolesAssign` permission boundary

Summary

Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.28.4, PUT /@warpgate/admin/api/users/:id/roles/:role_id reaches api_update_user_role in warpgate-admin/src/api/users.rs through AdminContext but does not require AdminPermission::AccessRolesAssign. A limited administrator with any permission can update expires_at on an existing UserRoleAssignment and clear revoked_at, extending an expiring grant or reinstating a revoked grant. The endpoint cannot create a role assignment that never existed because it returns not found without a matching user and role pair. This issue is fixed in version 0.28.4.

Severity

6 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-22 14:12 UTC

CWE

CWE-862 - Missing Authorization

Assigner

GitHub_M mitre root

References

3 references

URL	Tags
https://github.com/warp-tech/warpgate/security/ad…	x_refsource_CONFIRM
https://github.com/warp-tech/warpgate/commit/c020…	x_refsource_MISC
https://github.com/warp-tech/warpgate/releases/ta…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
warp-tech	warpgate	Affected: < 0.28.4

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-91167",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-22T14:12:28.626585Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-22T15:40:23.360Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "warpgate",
          "vendor": "warp-tech",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.28.4"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.28.4, PUT /@warpgate/admin/api/users/:id/roles/:role_id reaches api_update_user_role in warpgate-admin/src/api/users.rs through AdminContext but does not require AdminPermission::AccessRolesAssign. A limited administrator with any permission can update expires_at on an existing UserRoleAssignment and clear revoked_at, extending an expiring grant or reinstating a revoked grant. The endpoint cannot create a role assignment that never existed because it returns not found without a matching user and role pair. This issue is fixed in version 0.28.4."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 6,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862: Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-21T18:54:38.214Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/warp-tech/warpgate/security/advisories/GHSA-fjgc-484v-j6mf",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/warp-tech/warpgate/security/advisories/GHSA-fjgc-484v-j6mf"
        },
        {
          "name": "https://github.com/warp-tech/warpgate/commit/c020900a9d85989e4280bd03184976bc33e2e61d",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/warp-tech/warpgate/commit/c020900a9d85989e4280bd03184976bc33e2e61d"
        },
        {
          "name": "https://github.com/warp-tech/warpgate/releases/tag/v0.28.4",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/warp-tech/warpgate/releases/tag/v0.28.4"
        }
      ],
      "source": {
        "advisory": "GHSA-fjgc-484v-j6mf",
        "discovery": "UNKNOWN"
      },
      "title": "Warpgate: Missing authorization check on `PUT /users/:id/roles/:role_id` allows any admin to bypass the `AccessRolesAssign` permission boundary"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-91167",
    "datePublished": "2026-09-21T18:54:38.214Z",
    "dateReserved": "2026-09-14T21:20:41.196Z",
    "dateUpdated": "2026-09-22T15:40:23.360Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-91166 (GCVE-0-2026-91166)

Vulnerability from cvelistv5 – Published: 2026-09-21 18:53 – Updated: 2026-09-24 22:32

Title

Warpgate: Web SSH stores a jump host's key against the target's address, so it validates as the target

Summary

Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. From 0.25.0 until 0.27.6, the browser SSH path in warpgate-web-ssh/src/manager.rs handles RCEvent::HostKeyUnknown without the presenting hop identity and instead passes ssh_options.host and ssh_options.port for the final target to KnownHosts::trust. In Prompt and AutoAccept modes, a jump host key can therefore be stored for the target address. A machine later presenting the jump host key at the target address can be accepted as the target, allowing interception of user traffic and a newly issued certificate when certificate authentication is used. The native SSH path is unaffected because it tracks each hop separately. This issue is fixed in version 0.27.6.

Severity

5.7 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-24 22:31 UTC

CWE

CWE-297 - Improper Validation of Certificate with Host Mismatch
CWE-923 - Improper Restriction of Communication Channel to Intended Endpoints

Assigner

GitHub_M mitre root

References

3 references

URL	Tags
https://github.com/warp-tech/warpgate/security/ad…	x_refsource_CONFIRM
https://github.com/warp-tech/warpgate/commit/fb66…	x_refsource_MISC
https://github.com/warp-tech/warpgate/releases/ta…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
warp-tech	warpgate	Affected: >= 0.25.0, < 0.27.6

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-91166",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-24T22:31:49.029825Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-24T22:32:09.888Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/warp-tech/warpgate/security/advisories/GHSA-w9jj-vpw3-5r8f"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "warpgate",
          "vendor": "warp-tech",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 0.25.0, \u003c 0.27.6"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. From 0.25.0 until 0.27.6, the browser SSH path in warpgate-web-ssh/src/manager.rs handles RCEvent::HostKeyUnknown without the presenting hop identity and instead passes ssh_options.host and ssh_options.port for the final target to KnownHosts::trust. In Prompt and AutoAccept modes, a jump host key can therefore be stored for the target address. A machine later presenting the jump host key at the target address can be accepted as the target, allowing interception of user traffic and a newly issued certificate when certificate authentication is used. The native SSH path is unaffected because it tracks each hop separately. This issue is fixed in version 0.27.6."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.7,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-297",
              "description": "CWE-297: Improper Validation of Certificate with Host Mismatch",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-923",
              "description": "CWE-923: Improper Restriction of Communication Channel to Intended Endpoints",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-21T18:53:56.224Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/warp-tech/warpgate/security/advisories/GHSA-w9jj-vpw3-5r8f",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/warp-tech/warpgate/security/advisories/GHSA-w9jj-vpw3-5r8f"
        },
        {
          "name": "https://github.com/warp-tech/warpgate/commit/fb66ff74f979c22054f4d348cc0d9065cc67e5d3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/warp-tech/warpgate/commit/fb66ff74f979c22054f4d348cc0d9065cc67e5d3"
        },
        {
          "name": "https://github.com/warp-tech/warpgate/releases/tag/v0.27.6",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/warp-tech/warpgate/releases/tag/v0.27.6"
        }
      ],
      "source": {
        "advisory": "GHSA-w9jj-vpw3-5r8f",
        "discovery": "UNKNOWN"
      },
      "title": "Warpgate: Web SSH stores a jump host\u0027s key against the target\u0027s address, so it validates as the target"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-91166",
    "datePublished": "2026-09-21T18:53:56.224Z",
    "dateReserved": "2026-09-14T21:20:41.196Z",
    "dateUpdated": "2026-09-24T22:32:09.888Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-91165 (GCVE-0-2026-91165)

Vulnerability from cvelistv5 – Published: 2026-09-21 18:53 – Updated: 2026-09-21 19:26

Title

Warpgate: Markup injection in SSO form_post return page via unencoded redirect/error values

Summary

Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.27.6, the response_mode=form_post SSO return path in warpgate-protocol-http/src/api/sso_provider_list.rs uses serde_json::to_string inside ReturnToSsoPostResponse without neutralizing a script-closing sequence. The vulnerable value can enter the script block through the attacker-controlled next redirect parameter stored by warpgate-protocol-http/src/api/sso_provider_detail.rs or through IdP-derived error messages that make_redirect_url concatenates without URL encoding. The IdP-derived path is reachable when the attacker controls a configured identity provider, or when the attacker controls the email or username claim on an attacker-controlled account and the configured identity provider permits the required unvalidated claim format. A victim must complete the form_post SSO flow for the injected markup to be rendered. The Warpgate Content-Security-Policy blocks injected JavaScript and event handlers, so the demonstrated impact is content spoofing, a false login form, or a meta refresh rather than script execution. This issue is fixed in version 0.27.6.

Severity

2.4 (Low)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-21 19:26 UTC

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

GitHub_M mitre root

References

3 references

URL	Tags
https://github.com/warp-tech/warpgate/security/ad…	x_refsource_CONFIRM
https://github.com/warp-tech/warpgate/commit/e944…	x_refsource_MISC
https://github.com/warp-tech/warpgate/releases/ta…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
warp-tech	warpgate	Affected: < 0.27.6

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-91165",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-21T19:26:11.810922Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-21T19:26:22.695Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "warpgate",
          "vendor": "warp-tech",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.27.6"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.27.6, the response_mode=form_post SSO return path in warpgate-protocol-http/src/api/sso_provider_list.rs uses serde_json::to_string inside ReturnToSsoPostResponse without neutralizing a script-closing sequence. The vulnerable value can enter the script block through the attacker-controlled next redirect parameter stored by warpgate-protocol-http/src/api/sso_provider_detail.rs or through IdP-derived error messages that make_redirect_url concatenates without URL encoding. The IdP-derived path is reachable when the attacker controls a configured identity provider, or when the attacker controls the email or username claim on an attacker-controlled account and the configured identity provider permits the required unvalidated claim format. A victim must complete the form_post SSO flow for the injected markup to be rendered. The Warpgate Content-Security-Policy blocks injected JavaScript and event handlers, so the demonstrated impact is content spoofing, a false login form, or a meta refresh rather than script execution. This issue is fixed in version 0.27.6."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 2.4,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-21T18:53:03.854Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/warp-tech/warpgate/security/advisories/GHSA-vvpj-p7j8-4rv4",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/warp-tech/warpgate/security/advisories/GHSA-vvpj-p7j8-4rv4"
        },
        {
          "name": "https://github.com/warp-tech/warpgate/commit/e94425a08f501383a67316673749dcbd637c6ce3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/warp-tech/warpgate/commit/e94425a08f501383a67316673749dcbd637c6ce3"
        },
        {
          "name": "https://github.com/warp-tech/warpgate/releases/tag/v0.27.6",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/warp-tech/warpgate/releases/tag/v0.27.6"
        }
      ],
      "source": {
        "advisory": "GHSA-vvpj-p7j8-4rv4",
        "discovery": "UNKNOWN"
      },
      "title": "Warpgate: Markup injection in SSO form_post return page via unencoded redirect/error values"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-91165",
    "datePublished": "2026-09-21T18:53:03.854Z",
    "dateReserved": "2026-09-14T21:20:41.196Z",
    "dateUpdated": "2026-09-21T19:26:22.695Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-91164 (GCVE-0-2026-91164)

Vulnerability from cvelistv5 – Published: 2026-09-21 18:50 – Updated: 2026-09-21 19:07

Title

Warpgate: API tokens bypass the user's allowed_ip_ranges restriction

Summary

Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. From 0.23.0 until 0.27.3, HTTP API token authentication resolves ConfigProvider::validate_api_token into RequestAuthorization::UserToken without enforcing the owning user's allowed_ip_ranges against the trusted client address in warpgate-protocol-http/src/common.rs. An attacker holding a leaked, phished, or exfiltrated X-Warpgate-Token can therefore use it from a prohibited network location. Deployments without allowed_ip_ranges are unaffected, and HTTP target proxying plus SSH, MySQL, PostgreSQL, RDP, VNC, and Kubernetes paths do not accept this vulnerable HTTP token flow. This issue is fixed in version 0.27.3.

Severity

4.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-21 19:06 UTC

CWE

CWE-284 - Improper Access Control
CWE-863 - Incorrect Authorization

Assigner

GitHub_M mitre root

References

4 references

URL	Tags
https://github.com/warp-tech/warpgate/security/ad…	x_refsource_CONFIRM
https://github.com/warp-tech/warpgate/pull/2356	x_refsource_MISC
https://github.com/warp-tech/warpgate/commit/8cb3…	x_refsource_MISC
https://github.com/warp-tech/warpgate/releases/ta…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
warp-tech	warpgate	Affected: >= 0.23.0, < 0.27.3

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-91164",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-21T19:06:54.705180Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-21T19:07:48.833Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "warpgate",
          "vendor": "warp-tech",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 0.23.0, \u003c 0.27.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. From 0.23.0 until 0.27.3, HTTP API token authentication resolves ConfigProvider::validate_api_token into RequestAuthorization::UserToken without enforcing the owning user\u0027s allowed_ip_ranges against the trusted client address in warpgate-protocol-http/src/common.rs. An attacker holding a leaked, phished, or exfiltrated X-Warpgate-Token can therefore use it from a prohibited network location. Deployments without allowed_ip_ranges are unaffected, and HTTP target proxying plus SSH, MySQL, PostgreSQL, RDP, VNC, and Kubernetes paths do not accept this vulnerable HTTP token flow. This issue is fixed in version 0.27.3."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-284",
              "description": "CWE-284: Improper Access Control",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863: Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-21T18:50:40.797Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/warp-tech/warpgate/security/advisories/GHSA-qmr2-wp96-h9ff",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/warp-tech/warpgate/security/advisories/GHSA-qmr2-wp96-h9ff"
        },
        {
          "name": "https://github.com/warp-tech/warpgate/pull/2356",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/warp-tech/warpgate/pull/2356"
        },
        {
          "name": "https://github.com/warp-tech/warpgate/commit/8cb33a1a7c447ab0cde3a1ee9f95bf9dde905482",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/warp-tech/warpgate/commit/8cb33a1a7c447ab0cde3a1ee9f95bf9dde905482"
        },
        {
          "name": "https://github.com/warp-tech/warpgate/releases/tag/v0.27.3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/warp-tech/warpgate/releases/tag/v0.27.3"
        }
      ],
      "source": {
        "advisory": "GHSA-qmr2-wp96-h9ff",
        "discovery": "UNKNOWN"
      },
      "title": "Warpgate: API tokens bypass the user\u0027s allowed_ip_ranges restriction"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-91164",
    "datePublished": "2026-09-21T18:50:40.797Z",
    "dateReserved": "2026-09-14T21:20:41.196Z",
    "dateUpdated": "2026-09-21T19:07:48.833Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-63330 (GCVE-0-2026-63330)

Vulnerability from cvelistv5 – Published: 2026-09-21 18:49 – Updated: 2026-09-23 19:03

Title

Warpgate: Missing Admin Authorization on Live Recording Stream WebSocket Allows Any Authenticated User to Eavesdrop on Terminal Sessions

Summary

Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.25.6, api_get_recording_stream in warpgate-admin/src/api/recordings_detail.rs protects /@warpgate/admin/api/recordings/{uuid}/stream only with session authentication and omits require_admin_permission for AdminPermission::RecordingsView. Any authenticated regular user who identifies an active recording can subscribe to its WebSocket and receive real-time terminal input and output from proxied SSH, MySQL, or PostgreSQL sessions, including credentials, commands, and other sensitive data belonging to users and administrators. This issue is fixed in version 0.25.6.

Severity

7.7 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-23 19:03 UTC

CWE

CWE-285 - Improper Authorization
CWE-862 - Missing Authorization

Assigner

GitHub_M mitre root

References

3 references

URL	Tags
https://github.com/warp-tech/warpgate/security/ad…	x_refsource_CONFIRM
https://github.com/warp-tech/warpgate/commit/f5cb…	x_refsource_MISC
https://github.com/warp-tech/warpgate/releases/ta…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
warp-tech	warpgate	Affected: < 0.25.6

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-63330",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-23T19:03:05.965475Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-23T19:03:11.343Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/warp-tech/warpgate/security/advisories/GHSA-2q37-6vxr-26jr"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "warpgate",
          "vendor": "warp-tech",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.25.6"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.25.6, api_get_recording_stream in warpgate-admin/src/api/recordings_detail.rs protects /@warpgate/admin/api/recordings/{uuid}/stream only with session authentication and omits require_admin_permission for AdminPermission::RecordingsView. Any authenticated regular user who identifies an active recording can subscribe to its WebSocket and receive real-time terminal input and output from proxied SSH, MySQL, or PostgreSQL sessions, including credentials, commands, and other sensitive data belonging to users and administrators. This issue is fixed in version 0.25.6."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-285",
              "description": "CWE-285: Improper Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862: Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-21T18:49:45.500Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/warp-tech/warpgate/security/advisories/GHSA-2q37-6vxr-26jr",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/warp-tech/warpgate/security/advisories/GHSA-2q37-6vxr-26jr"
        },
        {
          "name": "https://github.com/warp-tech/warpgate/commit/f5cb06ea09065f375870ccee64fe721a2ca79766",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/warp-tech/warpgate/commit/f5cb06ea09065f375870ccee64fe721a2ca79766"
        },
        {
          "name": "https://github.com/warp-tech/warpgate/releases/tag/v0.25.6",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/warp-tech/warpgate/releases/tag/v0.25.6"
        }
      ],
      "source": {
        "advisory": "GHSA-2q37-6vxr-26jr",
        "discovery": "UNKNOWN"
      },
      "title": "Warpgate: Missing Admin Authorization on Live Recording Stream WebSocket Allows Any Authenticated User to Eavesdrop on Terminal Sessions"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-63330",
    "datePublished": "2026-09-21T18:49:45.500Z",
    "dateReserved": "2026-07-16T14:14:24.384Z",
    "dateUpdated": "2026-09-23T19:03:11.343Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-63329 (GCVE-0-2026-63329)

Vulnerability from cvelistv5 – Published: 2026-09-21 18:49 – Updated: 2026-09-22 15:40

Title

Warpgate: x-warpgate-username Header Not Stripped from Client Requests Enables Identity Spoofing to WebSocket Backend Targets

Summary

Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.25.6, copy_server_request in warpgate-protocol-http/src/proxy.rs forwards a client-supplied x-warpgate-username header before inject_own_headers appends the authenticated username. Because the request builder preserves repeated values, a proxied backend that trusts the first x-warpgate-username value can authorize an authenticated attacker as another user. The same forwarding policy also accepts the reserved x-warpgate-authentication-type header, and warpgate-common/src/http_headers.rs does not exclude either reserved identity header. This issue is fixed in version 0.25.6.

Severity

4.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-22 14:12 UTC

CWE

CWE-116 - Improper Encoding or Escaping of Output
CWE-290 - Authentication Bypass by Spoofing

Assigner

GitHub_M mitre root

References

3 references

URL	Tags
https://github.com/warp-tech/warpgate/security/ad…	x_refsource_CONFIRM
https://github.com/warp-tech/warpgate/commit/c374…	x_refsource_MISC
https://github.com/warp-tech/warpgate/releases/ta…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
warp-tech	warpgate	Affected: < 0.25.6

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-63329",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-22T14:12:31.220504Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-22T15:40:33.501Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "warpgate",
          "vendor": "warp-tech",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.25.6"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.25.6, copy_server_request in warpgate-protocol-http/src/proxy.rs forwards a client-supplied x-warpgate-username header before inject_own_headers appends the authenticated username. Because the request builder preserves repeated values, a proxied backend that trusts the first x-warpgate-username value can authorize an authenticated attacker as another user. The same forwarding policy also accepts the reserved x-warpgate-authentication-type header, and warpgate-common/src/http_headers.rs does not exclude either reserved identity header. This issue is fixed in version 0.25.6."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-116",
              "description": "CWE-116: Improper Encoding or Escaping of Output",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-290",
              "description": "CWE-290: Authentication Bypass by Spoofing",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-21T18:49:01.603Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/warp-tech/warpgate/security/advisories/GHSA-862h-v6cc-9757",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/warp-tech/warpgate/security/advisories/GHSA-862h-v6cc-9757"
        },
        {
          "name": "https://github.com/warp-tech/warpgate/commit/c3748d7585209781b2d3a39ac9941b91d11d9b77",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/warp-tech/warpgate/commit/c3748d7585209781b2d3a39ac9941b91d11d9b77"
        },
        {
          "name": "https://github.com/warp-tech/warpgate/releases/tag/v0.25.6",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/warp-tech/warpgate/releases/tag/v0.25.6"
        }
      ],
      "source": {
        "advisory": "GHSA-862h-v6cc-9757",
        "discovery": "UNKNOWN"
      },
      "title": "Warpgate: x-warpgate-username Header Not Stripped from Client Requests Enables Identity Spoofing to WebSocket Backend Targets"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-63329",
    "datePublished": "2026-09-21T18:49:01.603Z",
    "dateReserved": "2026-07-16T14:14:24.384Z",
    "dateUpdated": "2026-09-22T15:40:33.501Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-58491 (GCVE-0-2026-58491)

Vulnerability from cvelistv5 – Published: 2026-09-21 18:48 – Updated: 2026-09-22 15:40

Title

Warpgate: Reflected XSS in SSO return endpoint via attacker-controlled next parameter

Summary

Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.25.5, the /@warpgate/api/sso/providers/:name/start endpoint stores an attacker-controlled next parameter that the POST /@warpgate/api/sso/return handler inserts without HTML escaping into the response generated by warpgate-protocol-http/src/api/sso_provider_list.rs. A victim who follows a crafted link and completes SSO can cause markup and JavaScript to execute in the authenticated Warpgate origin, allowing access to session data and actions through user APIs, and through administrator APIs only when the victim is an administrator. The GET /@warpgate/api/sso/return path also uses the same unvalidated value as a redirect destination, enabling an open redirect. This issue is fixed in version 0.25.5.

Severity

9.3 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-22 14:20 UTC

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

GitHub_M mitre root

References

3 references

URL	Tags
https://github.com/warp-tech/warpgate/security/ad…	x_refsource_CONFIRM
https://github.com/warp-tech/warpgate/commit/eab0…	x_refsource_MISC
https://github.com/warp-tech/warpgate/releases/ta…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
warp-tech	warpgate	Affected: < 0.25.5

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-58491",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-22T14:20:46.826766Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-22T15:40:39.937Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "warpgate",
          "vendor": "warp-tech",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.25.5"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.25.5, the /@warpgate/api/sso/providers/:name/start endpoint stores an attacker-controlled next parameter that the POST /@warpgate/api/sso/return handler inserts without HTML escaping into the response generated by warpgate-protocol-http/src/api/sso_provider_list.rs. A victim who follows a crafted link and completes SSO can cause markup and JavaScript to execute in the authenticated Warpgate origin, allowing access to session data and actions through user APIs, and through administrator APIs only when the victim is an administrator. The GET /@warpgate/api/sso/return path also uses the same unvalidated value as a redirect destination, enabling an open redirect. This issue is fixed in version 0.25.5."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 9.3,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-21T18:48:03.982Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/warp-tech/warpgate/security/advisories/GHSA-3c3w-75j2-7h74",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/warp-tech/warpgate/security/advisories/GHSA-3c3w-75j2-7h74"
        },
        {
          "name": "https://github.com/warp-tech/warpgate/commit/eab0548f018d95b5f96f8e913527000e05ed93a2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/warp-tech/warpgate/commit/eab0548f018d95b5f96f8e913527000e05ed93a2"
        },
        {
          "name": "https://github.com/warp-tech/warpgate/releases/tag/v0.25.5",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/warp-tech/warpgate/releases/tag/v0.25.5"
        }
      ],
      "source": {
        "advisory": "GHSA-3c3w-75j2-7h74",
        "discovery": "UNKNOWN"
      },
      "title": "Warpgate: Reflected XSS in SSO return endpoint via attacker-controlled next parameter"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-58491",
    "datePublished": "2026-09-21T18:48:03.982Z",
    "dateReserved": "2026-06-30T20:21:25.812Z",
    "dateUpdated": "2026-09-22T15:40:39.937Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-44347 (GCVE-0-2026-44347)

Vulnerability from cvelistv5 – Published: 2026-05-12 22:44 – Updated: 2026-05-13 15:36

Title

Warpgate: SSO CSRF -- State Token Not Validated on Return

Summary

Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.23.3, the SSO flow does not validate the state parameter, which makes it possible for an attacker to trick a user into logging into the attacker's account, possibly convincing them to perform sensitive actions on the attacker's account (such as writing sensitive data to the attacker's SSH target, or logging into an HTTP target that the attacker set up). This vulnerability is fixed in 0.23.3.

Severity

5.8 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:H/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-05-13 15:35 UTC

CWE

CWE-352 - Cross-Site Request Forgery (CSRF)

Assigner

GitHub_M mitre root

References

1 reference

URL	Tags
https://github.com/warp-tech/warpgate/security/ad…	x_refsource_CONFIRM

Impacted products

1 product

Vendor	Product	Version
warp-tech	warpgate	Affected: < 0.23.3

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-44347",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-13T15:35:20.915504Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-13T15:36:43.539Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/warp-tech/warpgate/security/advisories/GHSA-rj86-hm3r-c275"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "warpgate",
          "vendor": "warp-tech",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.23.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.23.3, the SSO flow does not validate the state parameter, which makes it possible for an attacker to trick a user into logging into the attacker\u0027s account, possibly convincing them to perform sensitive actions on the attacker\u0027s account (such as writing sensitive data to the attacker\u0027s SSH target, or logging into an HTTP target that the attacker set up). This vulnerability is fixed in 0.23.3."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-352",
              "description": "CWE-352: Cross-Site Request Forgery (CSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-12T22:44:17.831Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/warp-tech/warpgate/security/advisories/GHSA-rj86-hm3r-c275",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/warp-tech/warpgate/security/advisories/GHSA-rj86-hm3r-c275"
        }
      ],
      "source": {
        "advisory": "GHSA-rj86-hm3r-c275",
        "discovery": "UNKNOWN"
      },
      "title": "Warpgate: SSO CSRF -- State Token Not Validated on Return"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-44347",
    "datePublished": "2026-05-12T22:44:17.831Z",
    "dateReserved": "2026-05-05T19:52:59.148Z",
    "dateUpdated": "2026-05-13T15:36:43.539Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2023-48712 (GCVE-0-2023-48712)

Vulnerability from cvelistv5 – Published: 2023-11-24 17:02 – Updated: 2024-08-02 21:37

Title

User authorization bug leading to privilege escalation in warpgate

Summary

Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. In affected versions there is a privilege escalation vulnerability through a non-admin user's account. Limited users can impersonate another user's account if only single-factor authentication is configured. If a user knows an admin username, opens the login screen and attempts to authenticate with an incorrect password they can subsequently enter a valid non-admin username and password they will be logged in as the admin user. All installations prior to version 0.9.0 are affected. All users are advised to upgrade. There are no known workarounds for this vulnerability.

Severity

7.1 (High)


                        
                          CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-863 - Incorrect Authorization

Assigner

GitHub_M mitre root

References

2 references

URL	Tags
https://github.com/warp-tech/warpgate/security/ad…	x_refsource_CONFIRM
https://github.com/warp-tech/warpgate/commit/e3b2…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
warp-tech	warpgate	Affected: < 0.9.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T21:37:54.649Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "https://github.com/warp-tech/warpgate/security/advisories/GHSA-c94j-vqr5-3mxr",
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/warp-tech/warpgate/security/advisories/GHSA-c94j-vqr5-3mxr"
          },
          {
            "name": "https://github.com/warp-tech/warpgate/commit/e3b26b2699257b9482dce2e9157bd9b5e05d9c76",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/warp-tech/warpgate/commit/e3b26b2699257b9482dce2e9157bd9b5e05d9c76"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "warpgate",
          "vendor": "warp-tech",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.9.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. In affected versions there is a privilege escalation vulnerability through a non-admin user\u0027s account. Limited users can impersonate another user\u0027s account if only single-factor authentication is configured. If a user knows an admin username, opens the login screen and attempts to authenticate with an incorrect password they can subsequently enter a valid non-admin username and password they will be logged in as the admin user. All installations prior to version 0.9.0 are affected. All users are advised to upgrade. There are no known workarounds for this vulnerability."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863: Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-11-24T17:02:59.929Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/warp-tech/warpgate/security/advisories/GHSA-c94j-vqr5-3mxr",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/warp-tech/warpgate/security/advisories/GHSA-c94j-vqr5-3mxr"
        },
        {
          "name": "https://github.com/warp-tech/warpgate/commit/e3b26b2699257b9482dce2e9157bd9b5e05d9c76",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/warp-tech/warpgate/commit/e3b26b2699257b9482dce2e9157bd9b5e05d9c76"
        }
      ],
      "source": {
        "advisory": "GHSA-c94j-vqr5-3mxr",
        "discovery": "UNKNOWN"
      },
      "title": "User authorization bug leading to privilege escalation in warpgate"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2023-48712",
    "datePublished": "2023-11-24T17:02:59.929Z",
    "dateReserved": "2023-11-17T19:43:37.555Z",
    "dateUpdated": "2024-08-02T21:37:54.649Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-43660 (GCVE-0-2023-43660)

Vulnerability from cvelistv5 – Published: 2023-09-27 21:00 – Updated: 2024-09-20 19:34

Title

SSH key password bypassed in warpgate

Summary

Warpgate is a smart SSH, HTTPS and MySQL bastion host for Linux that doesn't need special client apps. The SSH key verification for a user can be bypassed by sending an SSH key offer without a signature. This allows bypassing authentication under following conditions: 1. The attacker knows the username and a valid target name 2. The attacked knows the user's public key and 3. Only SSH public key authentication is required for the user account. This issue has been addressed in version 0.8.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Severity

4.8 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-09-20 17:51 UTC

CWE

CWE-287 - Improper Authentication

Assigner

GitHub_M mitre root

References

2 references

URL	Tags
https://github.com/warp-tech/warpgate/security/ad…	x_refsource_CONFIRM
https://github.com/warp-tech/warpgate/commit/a4df…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
warp-tech	warpgate	Affected: < 0.8.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T19:44:43.825Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "https://github.com/warp-tech/warpgate/security/advisories/GHSA-3cjp-w4cp-m9c8",
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/warp-tech/warpgate/security/advisories/GHSA-3cjp-w4cp-m9c8"
          },
          {
            "name": "https://github.com/warp-tech/warpgate/commit/a4df7f7a21395cfaee7a9789d1e3846290caeb63",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/warp-tech/warpgate/commit/a4df7f7a21395cfaee7a9789d1e3846290caeb63"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-43660",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-20T17:51:05.559514Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-20T19:34:17.363Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "warpgate",
          "vendor": "warp-tech",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.8.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Warpgate is a smart SSH, HTTPS and MySQL bastion host for Linux that doesn\u0027t need special client apps. The SSH key verification for a user can be bypassed by sending an SSH key offer without a signature. This allows bypassing authentication under following conditions: 1. The attacker knows the username and a valid target name 2. The attacked knows the user\u0027s public key and 3. Only SSH public key authentication is required for the user account. This issue has been addressed in version 0.8.1. Users are advised to upgrade. There are no known workarounds for this vulnerability."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-287",
              "description": "CWE-287: Improper Authentication",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-09-27T21:00:29.827Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/warp-tech/warpgate/security/advisories/GHSA-3cjp-w4cp-m9c8",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/warp-tech/warpgate/security/advisories/GHSA-3cjp-w4cp-m9c8"
        },
        {
          "name": "https://github.com/warp-tech/warpgate/commit/a4df7f7a21395cfaee7a9789d1e3846290caeb63",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/warp-tech/warpgate/commit/a4df7f7a21395cfaee7a9789d1e3846290caeb63"
        }
      ],
      "source": {
        "advisory": "GHSA-3cjp-w4cp-m9c8",
        "discovery": "UNKNOWN"
      },
      "title": "SSH key password bypassed in warpgate"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2023-43660",
    "datePublished": "2023-09-27T21:00:29.827Z",
    "dateReserved": "2023-09-20T15:35:38.148Z",
    "dateUpdated": "2024-09-20T19:34:17.363Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-37268 (GCVE-0-2023-37268)

Vulnerability from cvelistv5 – Published: 2023-07-14 21:02 – Updated: 2024-10-18 17:41

Title

User login confusion with SSO in warpgate

Summary

Warpgate is an SSH, HTTPS and MySQL bastion host for Linux that doesn't need special client apps. When logging in as a user with SSO enabled an attacker may authenticate as an other user. Any user account which does not have a second factor enabled could be compromised. This issue has been addressed in commit `8173f6512a` and in releases starting with version 0.7.3. Users are advised to upgrade. Users unable to upgrade should require their users to use a second factor in authentication.

Severity

6.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-10-18 17:30 UTC

CWE

CWE-287 - Improper Authentication

Assigner

GitHub_M mitre root

References

2 references

URL	Tags
https://github.com/warp-tech/warpgate/security/ad…	x_refsource_CONFIRM
https://github.com/warp-tech/warpgate/commit/8173…	x_refsource_MISC

Impacted products

2 products

Vendor	Product	Version
warp-tech	warpgate	Affected: < 0.7.3
warpgate_project	warpgate	Affected: 0 , < 0.7.3 (custom) cpe:2.3:a:warpgate_project:warpgate::::::::

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T17:09:33.241Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "https://github.com/warp-tech/warpgate/security/advisories/GHSA-868r-97g5-r9g4",
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/warp-tech/warpgate/security/advisories/GHSA-868r-97g5-r9g4"
          },
          {
            "name": "https://github.com/warp-tech/warpgate/commit/8173f6512ab6183fa5edc5c9a5f3760b8979271e",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/warp-tech/warpgate/commit/8173f6512ab6183fa5edc5c9a5f3760b8979271e"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:warpgate_project:warpgate:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "warpgate",
            "vendor": "warpgate_project",
            "versions": [
              {
                "lessThan": "0.7.3",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-37268",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-18T17:30:49.816727Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-18T17:41:24.928Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "warpgate",
          "vendor": "warp-tech",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.7.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Warpgate is an SSH, HTTPS and MySQL bastion host for Linux that doesn\u0027t need special client apps. When logging in as a user with SSO enabled an attacker may authenticate as an other user. Any user account which does not have a second factor enabled could be compromised. This issue has been addressed in commit `8173f6512a` and in releases starting with version 0.7.3. Users are advised to upgrade. Users unable to upgrade should require their users to use a second factor in authentication."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-287",
              "description": "CWE-287: Improper Authentication",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-07-14T21:02:00.786Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/warp-tech/warpgate/security/advisories/GHSA-868r-97g5-r9g4",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/warp-tech/warpgate/security/advisories/GHSA-868r-97g5-r9g4"
        },
        {
          "name": "https://github.com/warp-tech/warpgate/commit/8173f6512ab6183fa5edc5c9a5f3760b8979271e",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/warp-tech/warpgate/commit/8173f6512ab6183fa5edc5c9a5f3760b8979271e"
        }
      ],
      "source": {
        "advisory": "GHSA-868r-97g5-r9g4",
        "discovery": "UNKNOWN"
      },
      "title": "User login confusion with SSO in warpgate"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2023-37268",
    "datePublished": "2023-07-14T21:02:00.786Z",
    "dateReserved": "2023-06-29T19:35:26.438Z",
    "dateUpdated": "2024-10-18T17:41:24.928Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-28113 (GCVE-0-2023-28113)

Vulnerability from cvelistv5 – Published: 2023-03-16 00:00 – Updated: 2025-02-25 14:55

Title

russh may use insecure Diffie-Hellman keys

Summary

russh is a Rust SSH client and server library. Starting in version 0.34.0 and prior to versions 0.36.2 and 0.37.1, Diffie-Hellman key validation is insufficient, which can lead to insecure shared secrets and therefore breaks confidentiality. Connections between a russh client and server or those of a russh peer with some other misbehaving peer are most likely to be problematic. These may vulnerable to eavesdropping. Most other implementations reject such keys, so this is mainly an interoperability issue in such a case. This issue is fixed in versions 0.36.2 and 0.37.1

Severity

5.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-02-25 14:29 UTC

CWE

CWE-20 - Improper Input Validation
CWE-358 - Improperly Implemented Security Check for Standard

Assigner

GitHub_M mitre root

References

6 references

URL	Tags
https://github.com/warp-tech/russh/commit/d831a37…
https://github.com/warp-tech/russh/blob/master/ru…
https://github.com/warp-tech/russh/blob/master/ru…
https://github.com/warp-tech/russh/releases/tag/v0.36.2
https://github.com/warp-tech/russh/releases/tag/v0.37.1
https://github.com/warp-tech/russh/security/advis…

Impacted products

1 product

Vendor	Product	Version
warp-tech	russh	Affected: 0.34.0 , < 0.34.0* (custom) Affected: 0.36.2 , < 0.36.2 (custom) Affected: 0.37.0 , < 0.37.0* (custom) Affected: 0.37.1 , < 0.37.1 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T12:30:24.345Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/warp-tech/russh/commit/d831a3716d3719dc76f091fcea9d94bd4ef97c6e"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/warp-tech/russh/blob/master/russh/src/kex/dh/groups.rs#L72-L76"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/warp-tech/russh/blob/master/russh/src/kex/dh/groups.rs#L78-L81"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/warp-tech/russh/releases/tag/v0.36.2"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/warp-tech/russh/releases/tag/v0.37.1"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/warp-tech/russh/security/advisories/GHSA-cqvm-j2r2-hwpg"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-28113",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-25T14:29:28.461323Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-02-25T14:55:51.611Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "russh",
          "vendor": "warp-tech",
          "versions": [
            {
              "lessThan": "0.34.0*",
              "status": "affected",
              "version": "0.34.0",
              "versionType": "custom"
            },
            {
              "lessThan": "0.36.2",
              "status": "affected",
              "version": "0.36.2",
              "versionType": "custom"
            },
            {
              "lessThan": "0.37.0*",
              "status": "affected",
              "version": "0.37.0",
              "versionType": "custom"
            },
            {
              "lessThan": "0.37.1",
              "status": "affected",
              "version": "0.37.1",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "russh is a Rust SSH client and server library. Starting in version 0.34.0 and prior to versions 0.36.2 and 0.37.1, Diffie-Hellman key validation is insufficient, which can lead to insecure shared secrets and therefore breaks confidentiality. Connections between a russh client and server or those of a russh peer with some other misbehaving peer are most likely to be problematic. These may vulnerable to eavesdropping. Most other implementations reject such keys, so this is mainly an interoperability issue in such a case. This issue is fixed in versions 0.36.2 and 0.37.1"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20 Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-358",
              "description": "CWE-358 Improperly Implemented Security Check for Standard",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-03-16T00:00:00.000Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "url": "https://github.com/warp-tech/russh/commit/d831a3716d3719dc76f091fcea9d94bd4ef97c6e"
        },
        {
          "url": "https://github.com/warp-tech/russh/blob/master/russh/src/kex/dh/groups.rs#L72-L76"
        },
        {
          "url": "https://github.com/warp-tech/russh/blob/master/russh/src/kex/dh/groups.rs#L78-L81"
        },
        {
          "url": "https://github.com/warp-tech/russh/releases/tag/v0.36.2"
        },
        {
          "url": "https://github.com/warp-tech/russh/releases/tag/v0.37.1"
        },
        {
          "url": "https://github.com/warp-tech/russh/security/advisories/GHSA-cqvm-j2r2-hwpg"
        }
      ],
      "source": {
        "advisory": "GHSA-cqvm-j2r2-hwpg",
        "defect": [
          "GHSA-cqvm-j2r2-hwpg"
        ],
        "discovery": "UNKNOWN"
      },
      "title": "russh may use insecure Diffie-Hellman keys",
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2023-28113",
    "datePublished": "2023-03-16T00:00:00.000Z",
    "dateReserved": "2023-03-10T00:00:00.000Z",
    "dateUpdated": "2025-02-25T14:55:51.611Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Find a vulnerability

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

24 vulnerabilities by warp-tech

CVE-2026-91167 (GCVE-0-2026-91167)

CVE-2026-91166 (GCVE-0-2026-91166)

CVE-2026-91165 (GCVE-0-2026-91165)

CVE-2026-91164 (GCVE-0-2026-91164)

CVE-2026-63330 (GCVE-0-2026-63330)

CVE-2026-63329 (GCVE-0-2026-63329)

CVE-2026-58491 (GCVE-0-2026-58491)

CVE-2026-44347 (GCVE-0-2026-44347)

CVE-2023-48712 (GCVE-0-2023-48712)

CVE-2023-43660 (GCVE-0-2023-43660)

CVE-2023-37268 (GCVE-0-2023-37268)

CVE-2023-28113 (GCVE-0-2023-28113)

CVE-2026-91167 (GCVE-0-2026-91167)

CVE-2026-91166 (GCVE-0-2026-91166)

CVE-2026-91165 (GCVE-0-2026-91165)

CVE-2026-91164 (GCVE-0-2026-91164)

CVE-2026-63330 (GCVE-0-2026-63330)

CVE-2026-63329 (GCVE-0-2026-63329)

CVE-2026-58491 (GCVE-0-2026-58491)

CVE-2026-44347 (GCVE-0-2026-44347)

CVE-2023-48712 (GCVE-0-2023-48712)

CVE-2023-43660 (GCVE-0-2023-43660)

CVE-2023-37268 (GCVE-0-2023-37268)

CVE-2023-28113 (GCVE-0-2023-28113)

Find a vulnerability

Search criteria ⓘ Use this form to refine search results. Full-text search supports keyword queries with ranking and filtering. You can combine vendor, product, and sources to narrow results. Enable “Apply ordering” to sort by date instead of relevance.

24 vulnerabilities by warp-tech

CVE-2026-91167 (GCVE-0-2026-91167)

CVE-2026-91166 (GCVE-0-2026-91166)

CVE-2026-91165 (GCVE-0-2026-91165)

CVE-2026-91164 (GCVE-0-2026-91164)

CVE-2026-63330 (GCVE-0-2026-63330)

CVE-2026-63329 (GCVE-0-2026-63329)

CVE-2026-58491 (GCVE-0-2026-58491)

CVE-2026-44347 (GCVE-0-2026-44347)

CVE-2023-48712 (GCVE-0-2023-48712)

CVE-2023-43660 (GCVE-0-2023-43660)

CVE-2023-37268 (GCVE-0-2023-37268)

CVE-2023-28113 (GCVE-0-2023-28113)

CVE-2026-91167 (GCVE-0-2026-91167)

CVE-2026-91166 (GCVE-0-2026-91166)

CVE-2026-91165 (GCVE-0-2026-91165)

CVE-2026-91164 (GCVE-0-2026-91164)

CVE-2026-63330 (GCVE-0-2026-63330)

CVE-2026-63329 (GCVE-0-2026-63329)

CVE-2026-58491 (GCVE-0-2026-58491)

CVE-2026-44347 (GCVE-0-2026-44347)

CVE-2023-48712 (GCVE-0-2023-48712)

CVE-2023-43660 (GCVE-0-2023-43660)

CVE-2023-37268 (GCVE-0-2023-37268)

CVE-2023-28113 (GCVE-0-2023-28113)

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.