CVE-2026-63329

Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.25.6, copyserverrequest in warpgate-protocol-http/src/proxy.rs forwards a client-supplied x-warpgate-username header before injectownheaders appends the authenticated username. Because the request builder preserves...

CVE-2026-63329

Warpgate is an open source SSH, HTTPS, and MySQL bastion host for Linux. Prior to version 0.25.6 , the copy_server_request function in warpgate-protocol-http/src/proxy.rs forwards a client-supplied x-warpgate-username header before the authenticated username is injected via inject_own_headers. Be...

CVE-2026-63329 Warpgate: x-warpgate-username Header Not Stripped from Client Requests Enables Identity Spoofing to WebSocket Backend Targets

Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.25.6, copyserverrequest in warpgate-protocol-http/src/proxy.rs forwards a client-supplied x-warpgate-username header before injectownheaders appends the authenticated username. Because the request builder preserves...