warpgate

Warpgate — это умный и полностью прозрачный бастион-хост для SSH, HTTPS, Kubernetes, MySQL, PostgreSQL, RDP и VNC, не требующий клиентского приложения или SSH-обёртки. Разверните его в вашей DMZ, добавьте учётные записи пользователей и легко назначьте их конкретным хостам и URL-адресам в сети...

CVE-2026-91165

Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.27.6, the responsemode=formpost SSO return path in warpgate-protocol-http/src/api/ssoproviderlist.rs uses serdejson::tostring inside ReturnToSsoPostResponse without neutralizing a script-closing sequence. The...

CVE-2026-91166

Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. From 0.25.0 until 0.27.6, the browser SSH path in warpgate-web-ssh/src/manager.rs handles RCEvent::HostKeyUnknown without the presenting hop identity and instead passes sshoptions.host and sshoptions.port for the final target...

CVE-2026-91167

Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.28.4, PUT /@warpgate/admin/api/users/:id/roles/:roleid reaches apiupdateuserrole in warpgate-admin/src/api/users.rs through AdminContext but does not require AdminPermission::AccessRolesAssign. A limited...

CVE-2026-91164

Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. From 0.23.0 until 0.27.3, HTTP API token authentication resolves ConfigProvider::validateapitoken into RequestAuthorization::UserToken without enforcing the owning user's allowedipranges against the trusted client address in...

CVE-2026-63330

Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.25.6, apigetrecordingstream in warpgate-admin/src/api/recordingsdetail.rs protects /@warpgate/admin/api/recordings/uuid/stream only with session authentication and omits requireadminpermission for...

CVE-2026-63329

Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.25.6, copyserverrequest in warpgate-protocol-http/src/proxy.rs forwards a client-supplied x-warpgate-username header before injectownheaders appends the authenticated username. Because the request builder preserves...

CVE-2026-58491

Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.25.5, the /@warpgate/api/sso/providers/:name/start endpoint stores an attacker-controlled next parameter that the POST /@warpgate/api/sso/return handler inserts without HTML escaping into the response generated by...

CVE-2026-91167 Warpgate: Missing authorization check on `PUT /users/:id/roles/:role_id` allows any admin to bypass the `AccessRolesAssign` permission boundary

Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.28.4, PUT /@warpgate/admin/api/users/:id/roles/:roleid reaches apiupdateuserrole in warpgate-admin/src/api/users.rs through AdminContext but does not require AdminPermission::AccessRolesAssign. A limited...

CVE-2026-91167 Warpgate: Missing authorization check on `PUT /users/:id/roles/:role_id` allows any admin to bypass the `AccessRolesAssign` permission boundary

Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.28.4, PUT /@warpgate/admin/api/users/:id/roles/:roleid reaches apiupdateuserrole in warpgate-admin/src/api/users.rs through AdminContext but does not require AdminPermission::AccessRolesAssign. A limited...

CVE-2026-91167

Warpgate , an open-source SSH/HTTPS/MySQL bastion host for Linux, has a missing authorization check in the PUT /@warpgate/admin/api/users/:id/roles/:role_id endpoint. The handler api_update_user_role in warpgate-admin/src/api/users.rs routes through AdminContext but does not require AdminPermissi...

CVE-2026-91167 Warpgate: Missing authorization check on `PUT /users/:id/roles/:role_id` allows any admin to bypass the `AccessRolesAssign` permission boundary

Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.28.4, PUT /@warpgate/admin/api/users/:id/roles/:roleid reaches apiupdateuserrole in warpgate-admin/src/api/users.rs through AdminContext but does not require AdminPermission::AccessRolesAssign. A limited...

CVE-2026-91166 Warpgate: Web SSH stores a jump host's key against the target's address, so it validates as the target

Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. From 0.25.0 until 0.27.6, the browser SSH path in warpgate-web-ssh/src/manager.rs handles RCEvent::HostKeyUnknown without the presenting hop identity and instead passes sshoptions.host and sshoptions.port for the final target...

CVE-2026-91166 Warpgate: Web SSH stores a jump host's key against the target's address, so it validates as the target

Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. From 0.25.0 until 0.27.6, the browser SSH path in warpgate-web-ssh/src/manager.rs handles RCEvent::HostKeyUnknown without the presenting hop identity and instead passes sshoptions.host and sshoptions.port for the final target...

CVE-2026-91166 Warpgate: Web SSH stores a jump host's key against the target's address, so it validates as the target

Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. From 0.25.0 until 0.27.6, the browser SSH path in warpgate-web-ssh/src/manager.rs handles RCEvent::HostKeyUnknown without the presenting hop identity and instead passes sshoptions.host and sshoptions.port for the final target...

CVE-2026-91166

Warpgate is an open-source SSH, HTTPS, and MySQL bastion host for Linux. In versions 0.25.0 through 0.27.6 , the browser SSH path mishandles RCEvent::HostKeyUnknown by passing the final target's host and port to KnownHosts::trust instead of the presenting hop's identity. In Prompt and AutoAccept ...

CVE-2026-91165

Warpgate , an open source SSH/HTTPS/MySQL bastion host for Linux, is affected by a markup injection in its form_post SSO return path (prior to version 0.27.6). The root cause is that serde_json::to_string is used inside ReturnToSsoPostResponse without neutralizing a script-closing sequence, allow...

CVE-2026-91165 Warpgate: Markup injection in SSO form_post return page via unencoded redirect/error values

Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.27.6, the responsemode=formpost SSO return path in warpgate-protocol-http/src/api/ssoproviderlist.rs uses serdejson::tostring inside ReturnToSsoPostResponse without neutralizing a script-closing sequence. The...

CVE-2026-91165 Warpgate: Markup injection in SSO form_post return page via unencoded redirect/error values

Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.27.6, the responsemode=formpost SSO return path in warpgate-protocol-http/src/api/ssoproviderlist.rs uses serdejson::tostring inside ReturnToSsoPostResponse without neutralizing a script-closing sequence. The...

CVE-2026-91165 Warpgate: Markup injection in SSO form_post return page via unencoded redirect/error values

Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.27.6, the responsemode=formpost SSO return path in warpgate-protocol-http/src/api/ssoproviderlist.rs uses serdejson::tostring inside ReturnToSsoPostResponse without neutralizing a script-closing sequence. The...