CVE-2026-91163
Deferred Deferred - Pending Action

Authentication Bypass in Warpgate Kubernetes Listener

Publication date: 2026-11-04

Last updated on: 2026-11-04

Assigner: GitHub, Inc.

Description
Warpgate is an open source SSH, HTTPS, and MySQL bastion host for Linux. Prior to 0.29.0, the Kubernetes protocol listener uses AcceptAnyClientCert in warpgate-protocol-kubernetes/src/server/client_certs.rs to accept certificates at the TLS layer and defer validation to warpgate-protocol-kubernetes/src/server/auth.rs, where authentication and lookup failures are rendered verbatim in an HTTP 500 response body. The Kubernetes application in warpgate-protocol-kubernetes/src/server/mod.rs lacks the outer request-logging wrapper used by the HTTP protocol, and failures in warpgate-protocol-kubernetes/src/server/handlers.rs can short-circuit before its inner log point. An unauthenticated network client can therefore induce failures and receive ASN.1/DER parser diagnostics or sea_orm database errors without the attempt being recorded in the gateway log. The disclosed information is limited to internal diagnostics, and no user-data, integrity, or availability impact is established. This issue is fixed in version 0.29.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-04
Last Modified
2026-11-04
Generated
2026-11-04
AI Q&A
2026-11-04
EPSS Evaluated
N/A
NVD
CVE-2026-91163
EUVD
EUVD-2026-116941

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
warp-tech warpgate < 0.29.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-209 The product generates an error message that includes sensitive information about its environment, users, or associated data.
CWE-532 The product writes sensitive information to a log file.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Warpgate is an open source bastion host for SSH, HTTPS, and MySQL. This vulnerability exists in versions prior to 0.29.0 where the Kubernetes protocol listener accepts client certificates without proper validation at the TLS layer. Errors during authentication or lookup are exposed in HTTP 500 responses, revealing internal diagnostics like ASN.1/DER parser or database errors. The lack of request logging for the Kubernetes application means these failures go unrecorded in gateway logs.

Detection Guidance

Detection involves checking for unauthorized access attempts or unusual error responses in Kubernetes protocol logs. Monitor for HTTP 500 responses containing ASN.1/DER parser diagnostics or database errors. Verify if warpgate version is below 0.29.0.

Impact Analysis

An unauthenticated attacker could exploit this to trigger error messages that expose internal system details, such as parsing or database errors. While this does not directly compromise user data or system integrity, it may aid attackers in reconnaissance by revealing software versions, configurations, or potential weaknesses in the system.

Mitigation Strategies

Upgrade Warpgate to version 0.29.0 or later immediately. Ensure Kubernetes protocol listener logs are monitored for authentication failures. Restrict network access to the Kubernetes protocol port if not required.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-91163. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...