CVE-2026-91166Medium· 5.7▾ TwilightPoC availableWarpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. From 0.25.0 until 0.27.6, the browser SSH path in warpgate-web-ssh/src/manager.rs handles RCEvent::HostKeyUnknown without the presenting hop identity and instead pas…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 31.4 · likelihood 0 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 23.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.2%
Last analysed / modified upstream
0.2% → 0.3%
Exploit / PoC code exists
Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. From 0.25.0 until 0.27.6, the browser SSH path in warpgate-web-ssh/src/manager.rs handles RCEvent::HostKeyUnknown without the presenting hop identity and instead passes ssh_options.host and ssh_options.port for the final target to KnownHosts::trust. In Prompt and AutoAccept modes, a jump host key can therefore be stored for the target address. A machine later presenting the jump host key at the target address can be accepted as the target, allowing interception of user traffic and a newly issued certificate when certificate authentication is used. The native SSH path is unaffected because it tracks each hop separately. This issue is fixed in version 0.27.6.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-91165Low· 2.4Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux
CVE-2026-63330High· 7.7Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux
CVE-2026-91167Medium· 6.0Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux
CVE-2026-91164Medium· 4.3Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux
CVE-2026-63329Medium· 4.9Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux
CVE-2026-58491Critical· 9.3Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux