Read the docs
TI-2022-02054 Aliases CVE-2022-2225GHSA-f3c3-7x6f-c89r

Zero Trust Secure Web Gateway policies bypass using WARP client subcommands

Priority LOW 35CWE-284Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
Low · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-284.

Summary

By using warp-cli subcommands (disable-ethernet, disable-wifi), it was possible for a user without admin privileges to bypass configured Zero Trust security policies (e.g. Secure Web Gateway policies) and features such as 'Lock WARP switch'.

Why it matters now

EPSS 0.00194 9th percentileScored 2026-11-07
Fix Fixed WARP (Cloudflare): 2022.5.341.0, 2022.5.346, 2022.5.227.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
CloudflareWARPbefore 2022.5.341.02022.5.341.0Patch availableCNA
CloudflareWARPbefore 2022.5.3462022.5.346Patch availableCNA
CloudflareWARPbefore 2022.5.227.02022.5.227.0Patch availableCNA
  • WARP VendorCloudflare Affected before 2022.5.341.0 Fixed in 2022.5.341.0 Patch available CNA
  • WARP VendorCloudflare Affected before 2022.5.346 Fixed in 2022.5.346 Patch available CNA
  • WARP VendorCloudflare Affected before 2022.5.227.0 Fixed in 2022.5.227.0 Patch available CNA

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:cloudflare:warp:*:*:*:*:*:macos:*:*before 2022.5.227.0VulnerableCloudflare
cpe:2.3:a:cloudflare:warp:*:*:*:*:*:windows:*:*before 2022.5.341.0VulnerableCloudflare
cpe:2.3:a:cloudflare:warp:*:*:*:*:*:linux:*:*before 2022.5.346VulnerableCloudflare
  • cpe:2.3:a:cloudflare:warp:*:*:*:*:*:macos:*:* Versions before 2022.5.227.0 Vulnerable ·Cloudflare
  • cpe:2.3:a:cloudflare:warp:*:*:*:*:*:windows:*:* Versions before 2022.5.341.0 Vulnerable ·Cloudflare
  • cpe:2.3:a:cloudflare:warp:*:*:*:*:*:linux:*:* Versions before 2022.5.346 Vulnerable ·Cloudflare

Remediation

  • Fix · CNA WARP (Cloudflare) Fixed in 2022.5.341.0
  • Fix · CNA WARP (Cloudflare) Fixed in 2022.5.346
  • Fix · CNA WARP (Cloudflare) Fixed in 2022.5.227.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-2225
  2. 2026-10-03 Alias added: GHSA-f3c3-7x6f-c89r

References

Patch 1

  • TI-2022-04046 support_uri validation missing in WARP client for Windows CVSS 3.1HIGH 8.9
  • TI-2022-03068 Bypassing Cloudflare Zero Trust policies using warp-cli set-custom-endpoint command CVSS 3.1CRITICAL 9.8
  • TI-2023-01749 Remote access to warp-svc.exe in Cloudflare WARP CVSS 3.1HIGH 7.3
  • TI-2022-03240 Lock WARP switch bypass using warp-cli 'add-trusted-ssid' command CVSS 3.1HIGH 8.8
  • TI-2023-02579 Plaintext transmission of DNS requests in Windows 1.1.1.1 WARP client CVSS 3.1HIGH 7.4
  • TI-2023-01335 Local Privilege Escalation Vulnerability in WARP's MSI Installer CVSS 3.1HIGH 7.8
See all 15 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences