Medium severity · published Sep 21, 2026
CVE-2026-91164
Warpgate: API tokens bypass the user's allowed_ip_ranges restriction
4.3
CVSS
0.4%
EPSS
No
On KEV
Description
Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. From 0.23.0 until 0.27.3, HTTP API token authentication resolves ConfigProvider::validate_api_token into RequestAuthorization::UserToken without enforcing the owning user's allowed_ip_ranges against the trusted client address in warpgate-protocol-http/src/common.rs. An attacker holding a leaked, phished, or exfiltrated X-Warpgate-Token can therefore use it from a prohibited network location. Deployments without allowed_ip_ranges are unaffected, and HTTP target proxying plus SSH, MySQL, PostgreSQL, RDP, VNC, and Kubernetes paths do not accept this vulnerable HTTP token flow. This issue is fixed in version 0.27.3.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 36% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WA
warpgate · warp-tech
>= 0.23.0, < 0.27.3 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-91164
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-91164
github.com
https://github.com/warp-tech/warpgate/commit/8cb33a1a7c447ab0cde3a1ee9f95bf9dde905482
github.com
https://github.com/warp-tech/warpgate/pull/2356
github.com
https://github.com/warp-tech/warpgate/releases/tag/v0.27.3
github.com
https://github.com/warp-tech/warpgate/security/advisories/GHSA-qmr2-wp96-h9ff
More from warpgate
9.3
CVE-2026-58491
Warpgate: Reflected XSS in SSO return endpoint via attacker-controlled next parameter
7.7
CVE-2026-63330
Warpgate: Missing Admin Authorization on Live Recording Stream WebSocket Allows Any Authenticated User to Eavesdrop on Terminal Sessions
6.5
CVE-2026-44347
Warpgate: SSO CSRF -- State Token Not Validated on Return
6.0
CVE-2026-91167
Warpgate: Missing authorization check on `PUT /users/:id/roles/:role_id` allows any admin to bypass the `AccessRolesAssign` permission boundary
5.7
CVE-2026-91166
Warpgate: Web SSH stores a jump host's key against the target's address, so it validates as the target