WARP client manifest misconfiguration leading to Task Hijacking
Priority LOW 24CWE-200Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- Required
- Attack complexity
- High
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · Low · Low
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-200.
Summary
Due to a misconfiguration in the manifest file of the WARP client for Android, it was possible to a perform a task hijacking attack. An attacker could create a malicious mobile application which could hijack legitimate app and steal potentially sensitive information when installed on the victim's device.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00171 6th percentileScored 2026-11-07
Fix Fixed WARP (Cloudflare): <6.20
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Cloudflare | WARP | before <6.20 | <6.20 | Patch available | CNA |
- WARP VendorCloudflare Affected before <6.20 Fixed in <6.20 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:cloudflare:warp:*:*:*:*:*:android:*:* | before 6.20 | Vulnerable | Cloudflare |
- cpe:2.3:a:cloudflare:warp:*:*:*:*:*:android:*:* Versions before 6.20 Vulnerable ·Cloudflare
Remediation
- Fix · CNA WARP (Cloudflare) Fixed in <6.20
Timeline
- 2026-10-02 Threatist record created from CVE-2022-4457
References
More Cloudflare Warp vulnerabilities
- TI-2022-04046 support_uri validation missing in WARP client for Windows CVSS 3.1HIGH 8.9
- TI-2022-03068 Bypassing Cloudflare Zero Trust policies using warp-cli set-custom-endpoint command CVSS 3.1CRITICAL 9.8
- TI-2023-01749 Remote access to warp-svc.exe in Cloudflare WARP CVSS 3.1HIGH 7.3
- TI-2022-03240 Lock WARP switch bypass using warp-cli 'add-trusted-ssid' command CVSS 3.1HIGH 8.8
- TI-2023-02579 Plaintext transmission of DNS requests in Windows 1.1.1.1 WARP client CVSS 3.1HIGH 7.4
- TI-2023-01335 Local Privilege Escalation Vulnerability in WARP's MSI Installer CVSS 3.1HIGH 7.8
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences