jumpserver

An open-source PAM platform Bastion Host !license-shieldlicense-link !docs-shielddocs-link !deepwiki-shielddeepwiki-link !discord-shielddiscord-link !docker-shielddocker-link !github-release-shieldgithub-release-link !github-stars-shieldgithub-stars-link English · 中文简体 · 中文繁體 · 日本語 · Português...

jumpserver

Открытая платформа PAM хост-бастион Что такое JumpServer? JumpServer — это открытая платформа управления привилегированным доступом PAM, которая предоставляет командам DevOps и ИТ безопасный доступ по запросу к SSH, RDP, Kubernetes, базам данных и конечным точкам RemoteApp через веб-браузер...

warpgate

Warpgate는 클라이언트 앱이나 SSH 래퍼가 필요 없는 스마트하고 완전히 투명한 SSH, HTTPS, Kubernetes, MySQL, PostgreSQL, RDP 및 VNC 배스천 호스트입니다. DMZ에 설치하고, 사용자 계정을 추가한 뒤 네트워크 내의 특정 호스트와 URL에 쉽게 할당할 수 있습니다. Warpgate는 모든 세션을 기록하여 나중에 내장된 관리자 웹 UI를 통해 실시간으로 보고 재생할 수 있습니다. 브라우저 기반 SSH, RDP 및 VNC 접속이 내장되어 있으며, 네이티브 클라이언트도 계속 작동합니다. ...

the-bastion

🔒 The Bastion 개요 배스천은 운영 팀시스템 관리자, 개발자, 데이터베이스 관리자 등이 일반적으로 ssh를 사용하여 장치서버, 가상 머신, 클라우드 인스턴스, 네트워크 장비 등에 안전하게 연결하기 위한 유일한 진입점으로 사용되는 머신 클러스터입니다. The Bastion은 전체 인프라에 대한 인증, 권한 부여, 추적성 및 감사 가능성을 위한 메커니즘을 제공합니다. 사용자와 인프라 사이에 위치한 The Bastion은 중간에 추상화 계층을 추가하여 인프라가 운영 팀 구성원을 개별적으로 알 필요가 없도록 합니다. 각 팀...

Aker

Aker SSH шлюз Что такое Aker? Aker — это инструмент безопасности, который помогает настроить собственный SSH jump/бастион-хост на Linux. Названный в честь египетского божества, охранявшего границы, Aker действует как контрольная точка, через которую все ваши сисадмины и персонал поддержки получаю...

JumpServer > 3.6.4 - Information Disclosure

JumpServer is an open source bastion host and a professional operation and maintenance security audit system. Starting in version 3.0.0 and prior to versions 3.5.5 and 3.6.4, session replays can download without authentication. Session replays stored in S3, OSS, or other cloud storage are not...

CVE-2026-91167

Warpgate , an open-source SSH/HTTPS/MySQL bastion host for Linux, has a missing authorization check in the PUT /@warpgate/admin/api/users/:id/roles/:role_id endpoint. The handler api_update_user_role in warpgate-admin/src/api/users.rs routes through AdminContext but does not require AdminPermissi...

CVE-2026-91167 Warpgate: Missing authorization check on `PUT /users/:id/roles/:role_id` allows any admin to bypass the `AccessRolesAssign` permission boundary

Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.28.4, PUT /@warpgate/admin/api/users/:id/roles/:roleid reaches apiupdateuserrole in warpgate-admin/src/api/users.rs through AdminContext but does not require AdminPermission::AccessRolesAssign. A limited...

CVE-2026-91164 Warpgate: API tokens bypass the user's allowed_ip_ranges restriction

Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. From 0.23.0 until 0.27.3, HTTP API token authentication resolves ConfigProvider::validateapitoken into RequestAuthorization::UserToken without enforcing the owning user's allowedipranges against the trusted client address in...

CVE-2026-91164 Warpgate: API tokens bypass the user's allowed_ip_ranges restriction

Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. From 0.23.0 until 0.27.3, HTTP API token authentication resolves ConfigProvider::validateapitoken into RequestAuthorization::UserToken without enforcing the owning user's allowedipranges against the trusted client address in...

CVE-2026-91164

Warpgate is an open-source SSH, HTTPS, and MySQL bastion host for Linux. In versions 0.23.0 through 0.27.2 , the HTTP API token authentication flow fails to enforce the owning user's allowed_ip_ranges against the trusted client address, as the token is resolved without that check in warpgate-prot...

EUVD-2026-84060

Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.25.6, copyserverrequest in warpgate-protocol-http/src/proxy.rs forwards a client-supplied x-warpgate-username header before injectownheaders appends the authenticated username. Because the request builder preserves...

CVE-2026-58491 Warpgate: Reflected XSS in SSO return endpoint via attacker-controlled next parameter

Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.25.5, the /@warpgate/api/sso/providers/:name/start endpoint stores an attacker-controlled next parameter that the POST /@warpgate/api/sso/return handler inserts without HTML escaping into the response generated by...

jumpserver v5.0.0

An open-source PAM platform Bastion Host !license-shieldlicense-link !docs-shielddocs-link !deepwiki-shielddeepwiki-link !discord-shielddiscord-link !docker-shielddocker-link !github-release-shieldgithub-release-link !github-stars-shieldgithub-stars-link English · 中文简体 · 中文繁體 · 日本語 · Português...

warpgate v0.29.0-beta.1

Warpgate is a smart & fully transparent SSH, HTTPS, Kubernetes, MySQL, PostgreSQL, RDP and VNC bastion host that doesn't require a client app or an SSH wrapper. Set it up in your DMZ, add user accounts and easily assign them to specific hosts and URLs within the network. Warpgate will record ever...

warpgate v0.28.0-beta.1

Warpgate is a smart & fully transparent SSH, HTTPS, Kubernetes, MySQL, PostgreSQL, RDP and VNC bastion host that doesn't require a client app or an SSH wrapper. Set it up in your DMZ, add user accounts and easily assign them to specific hosts and URLs within the network. Warpgate will record ever...

CVE-2026-44347 Warpgate: SSO CSRF -- State Token Not Validated on Return

Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.23.3, the SSO flow does not validate the state parameter, which makes it possible for an attacker to trick a user into logging into the attacker's account, possibly convincing them to perform sensitive actions on t...

EUVD-2026-29882

Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.23.3, the SSO flow does not validate the state parameter, which makes it possible for an attacker to trick a user into logging into the attacker's account, possibly convincing them to perform sensitive actions on t...

PT-2026-40469

Name of the Vulnerable Software and Affected Versions Warpgate versions prior to 0.23.3 Description The SSO flow fails to validate the state parameter. This allows an attacker to trick a user into logging into an account controlled by the attacker, which could lead the user to perform sensitive...

CVE-2026-31798

JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to v4.10.16-lts, JumpServer improperly validates certificates in the Custom SMS API Client. When JumpServer sends MFA/OTP codes via Custom SMS API, an attacker can intercept the request and...