CVE-2026-91166 Details
Description
Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. From 0.25.0 until 0.27.6, the browser SSH path in warpgate-web-ssh/src/manager.rs handles RCEvent::HostKeyUnknown without the presenting hop identity and instead passes ssh_options.host and ssh_options.port for the final target to KnownHosts::trust. In Prompt and AutoAccept modes, a jump host key can therefore be stored for the target address. A machine later presenting the jump host key at the target address can be accepted as the target, allowing interception of user traffic and a newly issued certificate when certificate authentication is used. The native SSH path is unaffected because it tracks each hop separately. This issue is fixed in version 0.27.6.
A vulnerability exists in Warpgate versions 0.25.0 prior to 0.27.6, specifically within the Web SSH client. The issue arises when connecting to a target through a jump host, as the jump host's key is incorrectly recorded against the target's address. This flaw allows a machine to present the jump host's key at the target address and be accepted as the target, potentially intercepting user traffic and manipulating certificate authentication. The native SSH path is not affected, as it properly tracks each hop separately.
Users should upgrade to Warpgate version 0.27.6 or later. After upgrading, review and remove any incorrect known hosts entries that may have been created during previous connections via an external jump host.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 21, 2026CISA-ADP
Assessed Sep 24, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/warp-tech/warpgate/security/advisories/GHSA-w9jj-vpw3-5r8f | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/warp-tech/warpgate/commit/fb66ff74f979c22054f4d348cc0d9065cc67e5d3 | [email protected] | Source CodeVendor |
| https://github.com/warp-tech/warpgate/releases/tag/v0.27.6 | [email protected] | Release NotesVendor |
| https://github.com/warp-tech/warpgate/security/advisories/GHSA-w9jj-vpw3-5r8f | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-297 | Improper Validation of Certificate with Host Mismatch | [email protected] |
| CWE-923 | Improper Restriction of Communication Channel to Intended Endpoints | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| WarpGate | >= 0.25.0, <= 0.27.5 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 24, 2026 | CVE Modified | CISA-ADP |
| Sep 21, 2026 | New CVE Received | [email protected] |