CVE-2026-58491 Warpgate: Reflected XSS in SSO return endpoint via attacker-controlled next parameter

Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.25.5, the /@warpgate/api/sso/providers/:name/start endpoint stores an attacker-controlled next parameter that the POST /@warpgate/api/sso/return handler inserts without HTML escaping into the response generated by...

EUVD-2026-84059

Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.25.5, the /@warpgate/api/sso/providers/:name/start endpoint stores an attacker-controlled next parameter that the POST /@warpgate/api/sso/return handler inserts without HTML escaping into the response generated by...

CVE-2026-58491 Warpgate: Reflected XSS in SSO return endpoint via attacker-controlled next parameter

Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.25.5, the /@warpgate/api/sso/providers/:name/start endpoint stores an attacker-controlled next parameter that the POST /@warpgate/api/sso/return handler inserts without HTML escaping into the response generated by...

PT-2026-96213

Name of the Vulnerable Software and Affected Versions Warpgate versions prior to 0.25.5 Description The software fails to properly escape the next parameter stored via the '/@warpgate/api/sso/providers/:name/start' endpoint. This value is subsequently inserted without HTML escaping into the...

PT-2026-96226

Name of the Vulnerable Software and Affected Versions Warpgate versions prior to 0.28.4 Description An authorization bypass exists in the admin API where the endpoint "/@warpgate/admin/api/users/:id/roles/:role id" calls the api update user role function in warpgate-admin/src/api/users.rs without...

PT-2026-96224

Name of the Vulnerable Software and Affected Versions Warpgate versions prior to 0.27.6 Description The SSO return path using response mode=form post in the warpgate-protocol-http/src/api/sso provider list.rs file fails to neutralize script-closing sequences when using serde json::to string insid...

PT-2026-96222

Name of the Vulnerable Software and Affected Versions Warpgate versions 0.23.0 through 0.27.2 Description HTTP API token authentication fails to enforce the allowed ip ranges of the owning user against the trusted client address during the resolution of ConfigProvider::validate api token into...

PT-2026-96219

Name of the Vulnerable Software and Affected Versions Warpgate versions prior to 0.25.6 Description The copy server request function in warpgate-protocol-http/src/proxy.rs forwards a client-supplied x-warpgate-username header before the inject own headers function appends the authenticated...

PT-2026-96220

Name of the Vulnerable Software and Affected Versions Warpgate versions prior to 0.25.6 Description The api get recording stream function in warpgate-admin/src/api/recordings detail.rs fails to enforce the AdminPermission::RecordingsView requirement for the...

PT-2026-96225

Name of the Vulnerable Software and Affected Versions Warpgate versions 0.25.0 through 0.27.5 Description The browser SSH path in warpgate-web-ssh/src/manager.rs handles RCEvent::HostKeyUnknown without the presenting hop identity. Instead, it passes ssh options.host and ssh options.port for the...

CVE-2026-91167: Missing Authorization

Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.28.4, PUT /@warpgate/admin/api/users/:id/roles/:roleid reaches apiupdateuserrole in warpgate-admin/src/api/users.rs through AdminContext but does not require AdminPermission::AccessRolesAssign. A limited...

CVE-2026-91165: Improper Neutralization of Input During Web Page Generation

Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.27.6, the responsemode=formpost SSO return path in warpgate-protocol-http/src/api/ssoproviderlist.rs uses serdejson::tostring inside ReturnToSsoPostResponse without neutralizing a script-closing sequence. The...

CVE-2026-91164: Improper Access Control

Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. From 0.23.0 until 0.27.3, HTTP API token authentication resolves ConfigProvider::validateapitoken into RequestAuthorization::UserToken without enforcing the owning user's allowedipranges against the trusted client address in...

CVE-2026-63329: Improper Encoding or Escaping of Output

Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.25.6, copyserverrequest in warpgate-protocol-http/src/proxy.rs forwards a client-supplied x-warpgate-username header before injectownheaders appends the authenticated username. Because the request builder preserves...

CVE-2026-58491: Improper Neutralization of Input During Web Page Generation

Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.25.5, the /@warpgate/api/sso/providers/:name/start endpoint stores an attacker-controlled next parameter that the POST /@warpgate/api/sso/return handler inserts without HTML escaping into the response generated by...

CVE-2026-91166: Improper Validation of Certificate with Host Mismatch

Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. From 0.25.0 until 0.27.6, the browser SSH path in warpgate-web-ssh/src/manager.rs handles RCEvent::HostKeyUnknown without the presenting hop identity and instead passes sshoptions.host and sshoptions.port for the final target...

CVE-2026-63330: Improper Authorization

Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.25.6, apigetrecordingstream in warpgate-admin/src/api/recordingsdetail.rs protects /@warpgate/admin/api/recordings/uuid/stream only with session authentication and omits requireadminpermission for...

warpgate v0.29.0-beta.1

Warpgate is a smart & fully transparent SSH, HTTPS, Kubernetes, MySQL, PostgreSQL, RDP and VNC bastion host that doesn't require a client app or an SSH wrapper. Set it up in your DMZ, add user accounts and easily assign them to specific hosts and URLs within the network. Warpgate will record ever...

warpgate v0.28.0-beta.1

Warpgate is a smart & fully transparent SSH, HTTPS, Kubernetes, MySQL, PostgreSQL, RDP and VNC bastion host that doesn't require a client app or an SSH wrapper. Set it up in your DMZ, add user accounts and easily assign them to specific hosts and URLs within the network. Warpgate will record ever...

CVE-2026-44347

Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.23.3, the SSO flow does not validate the state parameter, which makes it possible for an attacker to trick a user into logging into the attacker's account, possibly convincing them to perform sensitive actions on t...