CVE-2026-91164 Details
Description
Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. From 0.23.0 until 0.27.3, HTTP API token authentication resolves ConfigProvider::validate_api_token into RequestAuthorization::UserToken without enforcing the owning user's allowed_ip_ranges against the trusted client address in warpgate-protocol-http/src/common.rs. An attacker holding a leaked, phished, or exfiltrated X-Warpgate-Token can therefore use it from a prohibited network location. Deployments without allowed_ip_ranges are unaffected, and HTTP target proxying plus SSH, MySQL, PostgreSQL, RDP, VNC, and Kubernetes paths do not accept this vulnerable HTTP token flow. This issue is fixed in version 0.27.3.
A vulnerability in Warpgate's HTTP API token authentication allows users' tokens to be validated without enforcing their specified allowed IP ranges. This issue affects Warpgate versions 0.23.0 to 0.27.3. As a result, an attacker with access to a valid API token could exploit this flaw by using the token from an unauthorized network location, bypassing IP restrictions. The vulnerability arises because the token validation process did not consider the user's IP allowances, leaving a gap that could be exploited. However, deployments that do not utilize allowed IP ranges are not affected.
Users can upgrade to Warpgate version 0.27.3, where this vulnerability has been fixed. After upgrading, it's recommended to revoke any API tokens that were issued to users with IP restrictions before the upgrade.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 21, 2026CISA-ADP
Assessed Sep 21, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/warp-tech/warpgate/commit/8cb33a1a7c447ab0cde3a1ee9f95bf9dde905482 | [email protected] | Source CodeVendor |
| https://github.com/warp-tech/warpgate/pull/2356 | [email protected] | Issue TrackingVendor |
| https://github.com/warp-tech/warpgate/releases/tag/v0.27.3 | [email protected] | Release NotesVendor |
| https://github.com/warp-tech/warpgate/security/advisories/GHSA-qmr2-wp96-h9ff | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-284 | Improper Access Control | [email protected] |
| CWE-863 | Incorrect Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| WarpGate | >= 0.23.0, < 0.27.3 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 21, 2026 | CVE Modified | CISA-ADP |
| Sep 21, 2026 | New CVE Received | [email protected] |