CVE-2026-91166

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-91166
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-91166.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-91166
Aliases
  • GHSA-w9jj-vpw3-5r8f
Published
2026-09-21T18:53:56Z
Modified
2026-09-22T03:45:48Z
Severity
  • 5.7 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N CVSS Calculator
Summary
Warpgate: Web SSH stores a jump host's key against the target's address, so it validates as the target
Details

Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. From 0.25.0 until 0.27.6, the browser SSH path in warpgate-web-ssh/src/manager.rs handles RCEvent::HostKeyUnknown without the presenting hop identity and instead passes ssh_options.host and ssh_options.port for the final target to KnownHosts::trust. In Prompt and AutoAccept modes, a jump host key can therefore be stored for the target address. A machine later presenting the jump host key at the target address can be accepted as the target, allowing interception of user traffic and a newly issued certificate when certificate authentication is used. The native SSH path is unaffected because it tracks each hop separately. This issue is fixed in version 0.27.6.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-297",
        "CWE-923"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91166.json"
}
References

Affected packages

Git / github.com/warp-tech/warpgate

Affected ranges

Type
GIT
Repo
https://github.com/warp-tech/warpgate
Events
Introduced
59c7093af80b9dc561c936a9ead20879ea9a409a
Fixed
3f166ef2fb27d3e6785df315fdc39914f0568404
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "0.25.0"
        },
        {
            "fixed":  "0.27.6"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Affected versions

chart-v0.*
chart-v0.0.6
chart-v0.0.7
v0.*
v0.25.0
v0.25.1
v0.25.2
v0.25.3
v0.25.4
v0.25.5
v0.26.0
v0.26.0-beta.1
v0.27.0
v0.27.0-beta.1
v0.27.0-beta.2
v0.27.0-beta.3
v0.27.0-beta.4
v0.27.0-beta.5
v0.27.1
v0.27.2
v0.27.3
v0.27.4
v0.27.5

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-91166.json"