Read the docs
TI-2026-85084 Aliases CVE-2026-91168

Warpgate Kubernetes authorization reuse by recreated same-name account

Priority LOW 30CWE-639Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
High
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-639.

Summary

Warpgate from 0.21.0 before 0.29.0 keys Kubernetes correlation entries by username, target name and client IP, not the immutable user UUID, and closing a session does not evict them. An attacker can use a newly created account with the same username as a deleted one to reuse its live entry for the same target from the same client IP before kubernetes.session_max_age expires. Authentication still occurs, but the reused entry skips a fresh target authorization check, letting Warpgate proxy requests with Kubernetes target credentials the account is not authorized to use (CWE-639). This can expose cluster resources or permit unauthorized changes.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

Description from the CNA

Warpgate is an open source SSH, HTTPS, and MySQL bastion host for Linux. From 0.21.0 until 0.29.0, the Kubernetes request correlator in warpgate-protocol-kubernetes/src/correlator.rs keys an authorized AdmittedTarget by username, target_name, and client IP rather than by the immutable user UUID, while KubernetesSessionHandle::close does not evict the entry. If an account is deleted and a different low-privilege account is created with the same username, the replacement account can successfully authenticate as that recreated username and reuse the predecessor's still-live correlation entry when requesting the same target from the same client IP before kubernetes.session_max_age expires. Current-request authentication still occurs, but the reused entry bypasses a fresh target authorization check and can cause Warpgate to proxy requests with Kubernetes target credentials that the replacement account is not authorized to use, exposing cluster resources or permitting unauthorized mutations. This issue is fixed in version 0.29.0.

Why it matters now

EPSS 0.0028 20th percentileScored 2026-11-07
Fix Fixed warpgate (warp-tech): 0.29.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
warp-techwarpgate0.21.0 to before 0.29.00.29.0Patch availableCNA
  • warpgate Vendorwarp-tech Affected 0.21.0 to before 0.29.0 Fixed in 0.29.0 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:warpgate_project:warpgate:*:*:*:*:*:*:*:*——warp-tech
  • cpe:2.3:a:warpgate_project:warpgate:*:*:*:*:*:*:*:* Versions — — ·warp-tech

Remediation

Upgrade warp-tech warpgate to version 0.29.0 or later, which fixes the issue. The sources list no other fixed version for warpgate.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

  • Fix · CNA warpgate (warp-tech) Fixed in 0.29.0

Timeline

  1. 2026-11-04 Threatist record created from CVE-2026-91168
  2. 2026-11-06 Priority changed: MEDIUM → LOW

References

Other 3

  • TI-2023-18898 User login confusion with SSO in warpgate CVSS 3.1HIGH 8.8
  • TI-2026-30510 Russh: Pre-auth DoS via unbounded allocation in keyboard-interactive auth CVSS 3.1HIGH 7.5
  • TI-2024-29059 Russh has an OOM Denial of Service due to allocation of untrusted amount CVSS 3.1HIGH 7.5
  • TI-2026-45163 Improper authorization in warp-tech warpgate CVSS 3.1HIGH 7.7
  • TI-2026-32313 Warpgate: SSO CSRF -- State Token Not Validated on Return CVSS 3.1MEDIUM 6.5
  • TI-2025-34558 Russh is missing an overflow check during channel windows adjust CVSS 3.1MEDIUM 6.5
See all 16 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences