CVE-2026-91166: medium-severity vulnerability in warp-tech warpgate
Warpgate: Web SSH stores a jump host's key against the target's address, so it validates as the target
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.7epss 0.2%
Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. From 0.25.0 until 0.27.6, the browser SSH path in warpgate-web-ssh/src/manager.rs handles RCEvent::HostKeyUnknown without the presenting hop identity and instead passes ssh_options.host and ssh_options.port for the final target to KnownHosts::trust. In Prompt and AutoAccept modes, a jump host key can therefore be stored for the target address. A machine later presenting the jump host key at the target address can be accepted as the target, allowing interception of user traffic and a newly issued certificate when certificate authentication is used. The native SSH path is unaffected because it tracks each hop separately. This issue is fixed in version 0.27.6.
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N
Affected products
warp-tech · warpgateRelated CVEs — warp-tech warpgate
In the same product, most dangerous first.
CVE-2023-48712HIGHUser authorization bug leading to privilege escalation in warpgateEPSS 0.7%CVE-2023-37268MEDIUMUser login confusion with SSO in warpgateEPSS 0.5%CVE-2026-63330HIGHWarpgate: Missing Admin Authorization on Live Recording Stream WebSocket Allows Any Authenticated User to Eavesdrop on Terminal SessionsEPSS 0.5%CVE-2026-58491CRITICALWarpgate: Reflected XSS in SSO return endpoint via attacker-controlled next parameterEPSS 0.5%CVE-2026-91164MEDIUMWarpgate: API tokens bypass the user's allowed_ip_ranges restrictionEPSS 0.4%CVE-2026-91167MEDIUMWarpgate: Missing authorization check on `PUT /users/:id/roles/:role_id` allows any admin to bypass the `AccessRolesAssign` permission boundaryEPSS 0.4%