CVE-2026-91168

Warpgate is an open source SSH, HTTPS, and MySQL bastion host for Linux. From 0.21.0 until 0.29.0, the Kubernetes request correlator in warpgate-protocol-kubernetes/src/correlator.rs keys an authorized AdmittedTarget by username, targetname, and client IP rather than by the immutable user UUID,...

CVE-2026-91168

The open-source bastion host Warpgate (versions 0.21.0 through 0.29.0) contains an authorization bypass vulnerability in the Kubernetes request correlator. The root cause is that the system keys authorized targets by username , target name, and client IP instead of an immutable user UUID, while f...

CVE-2026-91168: warp-tech warpgate: Warpgate is an open source SSH, HTTPS, and MySQL bastion host for Linux

Warpgate is an open source SSH, HTTPS, and MySQL bastion host for Linux. From 0.21.0 until 0.29.0, the Kubernetes request correlator in warpgate-protocol-kubernetes/src/correlator.rs keys an authorized AdmittedTarget by username, targetname, and client IP rather than by the immutable user UUID,...

PT-2026-136998

Warpgate is an open source SSH, HTTPS, and MySQL bastion host for Linux. From 0.21.0 until 0.29.0, the Kubernetes request correlator in warpgate-protocol-kubernetes/src/correlator.rs keys an authorized AdmittedTarget by username, target name, and client IP rather than by the immutable user UUID,...