jumpserver

An open-source PAM platform Bastion Host !license-shieldlicense-link !docs-shielddocs-link !deepwiki-shielddeepwiki-link !discord-shielddiscord-link !docker-shielddocker-link !github-release-shieldgithub-release-link !github-stars-shieldgithub-stars-link English · 中文简体 · 中文繁體 · 日本語 · Português...

warpgate

Warpgate is a smart & fully transparent SSH, HTTPS, Kubernetes, MySQL, PostgreSQL, RDP and VNC bastion host that doesn't require a client app or an SSH wrapper. Set it up in your DMZ, add user accounts and easily assign them to specific hosts and URLs within the network. Warpgate will record ever...

jumpserver

Открытая платформа PAM хост-бастион Что такое JumpServer? JumpServer — это открытая платформа управления привилегированным доступом PAM, которая предоставляет командам DevOps и ИТ безопасный доступ по запросу к SSH, RDP, Kubernetes, базам данных и конечным точкам RemoteApp через веб-браузер...

the-bastion

🔒 The Bastion Présentation Les bastions sont un groupe de machines utilisées comme point d'entrée unique par les équipes opérationnelles administrateurs systèmes, développeurs, administrateurs de bases de données, ... pour se connecter de manière sécurisée à des périphériques serveurs, machines...

Aker

Aker SSH Gateway What is Aker? Aker is a security tool that helps you configure your own Linux ssh jump/bastion host. Named after an Egyptian mythology deity who guarded the borders, Aker would act as choke point through which all your sysadmins and support staff access Linux production servers...

JumpServer > 3.6.4 - Information Disclosure

JumpServer is an open source bastion host and a professional operation and maintenance security audit system. Starting in version 3.0.0 and prior to versions 3.5.5 and 3.6.4, session replays can download without authentication. Session replays stored in S3, OSS, or other cloud storage are not...

CVE-2026-91167 Warpgate: Missing authorization check on `PUT /users/:id/roles/:role_id` allows any admin to bypass the `AccessRolesAssign` permission boundary

Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.28.4, PUT /@warpgate/admin/api/users/:id/roles/:roleid reaches apiupdateuserrole in warpgate-admin/src/api/users.rs through AdminContext but does not require AdminPermission::AccessRolesAssign. A limited...

CVE-2026-91167

Warpgate , an open-source SSH/HTTPS/MySQL bastion host for Linux, has a missing authorization check in the PUT /@warpgate/admin/api/users/:id/roles/:role_id endpoint. The handler api_update_user_role in warpgate-admin/src/api/users.rs routes through AdminContext but does not require AdminPermissi...

CVE-2026-91164 Warpgate: API tokens bypass the user's allowed_ip_ranges restriction

Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. From 0.23.0 until 0.27.3, HTTP API token authentication resolves ConfigProvider::validateapitoken into RequestAuthorization::UserToken without enforcing the owning user's allowedipranges against the trusted client address in...

CVE-2026-91164 Warpgate: API tokens bypass the user's allowed_ip_ranges restriction

Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. From 0.23.0 until 0.27.3, HTTP API token authentication resolves ConfigProvider::validateapitoken into RequestAuthorization::UserToken without enforcing the owning user's allowedipranges against the trusted client address in...

CVE-2026-91164

Warpgate is an open-source SSH, HTTPS, and MySQL bastion host for Linux. In versions 0.23.0 through 0.27.2 , the HTTP API token authentication flow fails to enforce the owning user's allowed_ip_ranges against the trusted client address, as the token is resolved without that check in warpgate-prot...

EUVD-2026-84060

Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.25.6, copyserverrequest in warpgate-protocol-http/src/proxy.rs forwards a client-supplied x-warpgate-username header before injectownheaders appends the authenticated username. Because the request builder preserves...

CVE-2026-58491 Warpgate: Reflected XSS in SSO return endpoint via attacker-controlled next parameter

Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.25.5, the /@warpgate/api/sso/providers/:name/start endpoint stores an attacker-controlled next parameter that the POST /@warpgate/api/sso/return handler inserts without HTML escaping into the response generated by...

jumpserver v5.0.0

An open-source PAM platform Bastion Host !license-shieldlicense-link !docs-shielddocs-link !deepwiki-shielddeepwiki-link !discord-shielddiscord-link !docker-shielddocker-link !github-release-shieldgithub-release-link !github-stars-shieldgithub-stars-link English · 中文简体 · 中文繁體 · 日本語 · Português...

warpgate v0.29.0-beta.1

Warpgate is a smart & fully transparent SSH, HTTPS, Kubernetes, MySQL, PostgreSQL, RDP and VNC bastion host that doesn't require a client app or an SSH wrapper. Set it up in your DMZ, add user accounts and easily assign them to specific hosts and URLs within the network. Warpgate will record ever...

warpgate v0.28.0-beta.1

Warpgate is a smart & fully transparent SSH, HTTPS, Kubernetes, MySQL, PostgreSQL, RDP and VNC bastion host that doesn't require a client app or an SSH wrapper. Set it up in your DMZ, add user accounts and easily assign them to specific hosts and URLs within the network. Warpgate will record ever...

CVE-2026-44347 Warpgate: SSO CSRF -- State Token Not Validated on Return

Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.23.3, the SSO flow does not validate the state parameter, which makes it possible for an attacker to trick a user into logging into the attacker's account, possibly convincing them to perform sensitive actions on t...

EUVD-2026-29882

Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.23.3, the SSO flow does not validate the state parameter, which makes it possible for an attacker to trick a user into logging into the attacker's account, possibly convincing them to perform sensitive actions on t...

PT-2026-40469

Name of the Vulnerable Software and Affected Versions Warpgate versions prior to 0.23.3 Description The SSO flow fails to validate the state parameter. This allows an attacker to trick a user into logging into an account controlled by the attacker, which could lead the user to perform sensitive...

CVE-2026-31798

JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to v4.10.16-lts, JumpServer improperly validates certificates in the Custom SMS API Client. When JumpServer sends MFA/OTP codes via Custom SMS API, an attacker can intercept the request and...