CVE-2026-63329

Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.25.6, copy_server_request in warpgate-protocol-http/src/proxy.rs forwards a client-supplied x-warpgate-username header before inject_own_headers appends the authenticated username. Because the request builder preserves repeated values, a proxied backend that trusts the first x-warpgate-username value can authorize an authenticated attacker as another user. The same forwarding policy also accepts the reserved x-warpgate-authentication-type header, and warpgate-common/src/http_headers.rs does not exclude either reserved identity header. This issue is fixed in version 0.25.6.

• CWE-116
• CWE-290

• https://github.com/warp-tech/warpgate/commit/c3748d7585209781b2d3a39ac9941b91d11d9b77
• https://github.com/warp-tech/warpgate/releases/tag/v0.25.6
• https://github.com/warp-tech/warpgate/security/advisories/GHSA-862h-v6cc-9757

Published

Sep 21, 2026

Last Modified

Sep 24, 2026

Status

Deferred

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-63312NLTK before 3.10.0 contains an arbitrary local file read vul…7.5
• CVE-2026-633139Router before 0.4.72 contains a server-side request forgery…8.3
• CVE-2026-63317Arbitrary Class Instantiation via XML Feature Generator Desc…5.6
• CVE-2026-6332CWE-312: Cleartext Storage of Sensitive Information vulnerab…7.5
• CVE-2026-63325Redocly CLI makes OpenAPI validation, linting, and documenta…7.8
• CVE-2026-63328Trivy is a security scanner. Prior to 0.72.0, plugin manifes…6.8
• CVE-2026-6333Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13 fa…5
• CVE-2026-63330Warpgate is an open source SSH, HTTPS and MySQL bastion host…7.7
• CVE-2026-63334draw.io is a configurable diagramming and whiteboarding appl…6.8
• CVE-2026-63335The RabbitMQ Java client library allows Java and JVM-based a…6.3
• CVE-2026-63336The RabbitMQ Java client library allows Java and JVM-based a…5.1
• CVE-2026-63337The RabbitMQ Java client library allows Java and JVM-based a…7.5