CVE-2026-91168
Deferred Deferred - Pending Action

Authentication Bypass in Warpgate via Session Reuse

Publication date: 2026-11-04

Last updated on: 2026-11-04

Assigner: GitHub, Inc.

Description
Warpgate is an open source SSH, HTTPS, and MySQL bastion host for Linux. From 0.21.0 until 0.29.0, the Kubernetes request correlator in warpgate-protocol-kubernetes/src/correlator.rs keys an authorized AdmittedTarget by username, target_name, and client IP rather than by the immutable user UUID, while KubernetesSessionHandle::close does not evict the entry. If an account is deleted and a different low-privilege account is created with the same username, the replacement account can successfully authenticate as that recreated username and reuse the predecessor's still-live correlation entry when requesting the same target from the same client IP before kubernetes.session_max_age expires. Current-request authentication still occurs, but the reused entry bypasses a fresh target authorization check and can cause Warpgate to proxy requests with Kubernetes target credentials that the replacement account is not authorized to use, exposing cluster resources or permitting unauthorized mutations. This issue is fixed in version 0.29.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-04
Last Modified
2026-11-04
Generated
2026-11-04
AI Q&A
2026-11-04
EPSS Evaluated
N/A
NVD
CVE-2026-91168
EUVD
EUVD-2026-116940

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
warp-tech warpgate >= 0.21.0, < 0.29.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects Warpgate versions 0.21.0 to 0.29.0. It involves the Kubernetes request correlator using a key based on username, target name, and client IP instead of an immutable user UUID. When an account is deleted and recreated with the same username, the new account inherits the old account's authorization for Kubernetes targets due to retained correlation entries in memory. This allows unauthorized access until the session expires.

Detection Guidance

Check Warpgate logs for unauthorized Kubernetes access attempts or sessions using recreated usernames. Monitor for multiple successful authentications with the same username but different user UUIDs within the session_max_age window (default 30 minutes).

Commands to inspect: warpgate logs | grep -i 'kubernetes' | grep -i 'auth'; warpgate session list --show-uuid

Impact Analysis

An attacker could exploit this by creating a new account with the same username as a deleted one. They could then authenticate and reuse the old account's authorization to access Kubernetes targets they are not permitted to use. This could expose cluster resources or allow unauthorized changes to the cluster.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data or systems, violating compliance requirements for data protection and access control. It may result in breaches of GDPR's data protection principles or HIPAA's access control rules, potentially leading to legal and regulatory penalties.

Mitigation Strategies
  • Upgrade Warpgate to version 0.29.0 or later to apply the security fix.
  • Rotate credentials for all Kubernetes targets accessed via Warpgate to invalidate any existing sessions.
  • Review and revoke any unauthorized access that may have occurred due to this vulnerability.
  • Monitor for suspicious activity in Kubernetes clusters and Warpgate logs for signs of exploitation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-91168. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...