CVE-2026-91167
Received Received - Intake

Privilege Escalation in Warpgate via Role Assignment Manipulation

Publication date: 2026-09-21

Last updated on: 2026-09-21

Assigner: GitHub, Inc.

Description
Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.28.4, PUT /@warpgate/admin/api/users/:id/roles/:role_id reaches api_update_user_role in warpgate-admin/src/api/users.rs through AdminContext but does not require AdminPermission::AccessRolesAssign. A limited administrator with any permission can update expires_at on an existing UserRoleAssignment and clear revoked_at, extending an expiring grant or reinstating a revoked grant. The endpoint cannot create a role assignment that never existed because it returns not found without a matching user and role pair. This issue is fixed in version 0.28.4.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-21
Last Modified
2026-09-21
Generated
2026-09-22
AI Q&A
2026-09-21
EPSS Evaluated
N/A
NVD
CVE-2026-91167
EUVD
EUVD-2026-84065

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
warpgate warpgate 0.28.4
warp_tech warpgate to 0.28.4 (exc)
warp_tech warpgate to 0.28.3 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to version 0.28.4, the PUT endpoint /@warpgate/admin/api/users/:id/roles/:role_id allowed limited administrators to update user role assignments without requiring the AdminPermission::AccessRolesAssign permission. This could let them extend expiring grants or reinstate revoked ones, breaking the least-privilege model.

Detection Guidance

Check Warpgate version with: warpgate --version. If version is <=0.28.3, the system is vulnerable. Inspect admin role permissions for AccessRolesAssign. Review API logs for PUT requests to /@warpgate/admin/api/users/:id/roles/:role_id.

Impact Analysis

An attacker with any admin privileges could exploit this to extend access for users whose permissions should expire or reinstate revoked access. This undermines role management and could allow unauthorized access to systems or data managed by Warpgate.

Compliance Impact

This vulnerability could violate compliance requirements that mandate strict access controls and separation of duties, such as GDPR's data protection principles or HIPAA's access management rules. Unauthorized privilege escalation or reinstatement of access may lead to non-compliance with these regulations.

Mitigation Strategies

Upgrade Warpgate to version 0.28.4 or later immediately. Verify that limited admin users do not have AccessRolesAssign permission unless intended. Audit existing role assignments for unauthorized changes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-91167. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart