CVE-2026-91164

Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. From 0.23.0 until 0.27.3, HTTP API token authentication resolves ConfigProvider::validate_api_token into RequestAuthorization::UserToken without enforcing the owning user's allowed_ip_ranges against the trusted client address in warpgate-protocol-http/src/common.rs. An attacker holding a leaked, phished, or exfiltrated X-Warpgate-Token can therefore use it from a prohibited network location. Deployments without allowed_ip_ranges are unaffected, and HTTP target proxying plus SSH, MySQL, PostgreSQL, RDP, VNC, and Kubernetes paths do not accept this vulnerable HTTP token flow. This issue is fixed in version 0.27.3.

• CWE-284
• CWE-863

• https://github.com/warp-tech/warpgate/commit/8cb33a1a7c447ab0cde3a1ee9f95bf9dde905482
• https://github.com/warp-tech/warpgate/pull/2356
• https://github.com/warp-tech/warpgate/releases/tag/v0.27.3
• https://github.com/warp-tech/warpgate/security/advisories/GHSA-qmr2-wp96-h9ff

Published

Sep 21, 2026

Last Modified

Sep 24, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-91147A flaw was found in `cockpit-ws`. This vulnerability allows …5.9
• CVE-2026-91149A flaw was found in Cockpit. An unauthenticated remote attac…7.5
• CVE-2026-9115Insufficient policy enforcement in Service Worker in Google …4.3
• CVE-2026-9116Insufficient policy enforcement in ServiceWorker in Google C…4.3
• CVE-2026-91160OpenWA is a free, open source, self-hosted WhatsApp API gate…8.2
• CVE-2026-91161OpenWA is a free, open source, self-hosted WhatsApp API gate…6.4
• CVE-2026-91165Warpgate is an open source SSH, HTTPS and MySQL bastion host…2.4
• CVE-2026-91166Warpgate is an open source SSH, HTTPS and MySQL bastion host…5.7
• CVE-2026-91167Warpgate is an open source SSH, HTTPS and MySQL bastion host…6
• CVE-2026-9117Type Confusion in GFX in Google Chrome on Linux, ChromeOS pr…7.5
• CVE-2026-9118Use after free in XR in Google Chrome on Windows prior to 14…8.8
• CVE-2026-91181Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7…6.5