CVE-2026-63329 Details
Description
Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.25.6, copy_server_request in warpgate-protocol-http/src/proxy.rs forwards a client-supplied x-warpgate-username header before inject_own_headers appends the authenticated username. Because the request builder preserves repeated values, a proxied backend that trusts the first x-warpgate-username value can authorize an authenticated attacker as another user. The same forwarding policy also accepts the reserved x-warpgate-authentication-type header, and warpgate-common/src/http_headers.rs does not exclude either reserved identity header. This issue is fixed in version 0.25.6.
A vulnerability in Warpgate, an open-source SSH, HTTPS, and MySQL bastion host for Linux, allows authenticated users to spoof identities by injecting forged usernames into WebSocket requests. This issue affects Warpgate versions prior to 0.25.6. The vulnerability arises because the application forwards the 'x-warpgate-username' header from clients to backend servers without proper validation. As a result, an attacker can impersonate another user if the backend trusts this header for authentication.
Users can upgrade to Warpgate version 0.25.6, which addresses this vulnerability by adding the 'x-warpgate-username' and 'x-warpgate-authentication-type' headers to the 'DONT_FORWARD_HEADERS' list, preventing them from being forwarded from client requests to backend servers.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 21, 2026CISA-ADP
Assessed Sep 22, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/warp-tech/warpgate/commit/c3748d7585209781b2d3a39ac9941b91d11d9b77 | [email protected] | Source CodeVendor |
| https://github.com/warp-tech/warpgate/releases/tag/v0.25.6 | [email protected] | Release NotesVendor |
| https://github.com/warp-tech/warpgate/security/advisories/GHSA-862h-v6cc-9757 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-116 | Improper Encoding or Escaping of Output | [email protected] |
| CWE-290 | Authentication Bypass by Spoofing | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| WarpGate | < 0.25.6 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 22, 2026 | CVE Modified | CISA-ADP |
| Sep 21, 2026 | New CVE Received | [email protected] |