CVE-2026-91166
- Source
- https://cve.org/CVERecord?id=CVE-2026-91166
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-91166.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-91166
- Aliases
-
- GHSA-w9jj-vpw3-5r8f
- Published
- 2026-09-21T18:53:56Z
- Modified
- 2026-10-28T02:31:03Z
- Severity
-
- 5.7 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N CVSS Calculator
- Summary
- Warpgate: Web SSH stores a jump host's key against the target's address, so it validates as the target
- Details
-
Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. From 0.25.0 until 0.27.6, the browser SSH path in warpgate-web-ssh/src/manager.rs handles RCEvent::HostKeyUnknown without the presenting hop identity and instead passes ssh_options.host and ssh_options.port for the final target to KnownHosts::trust. In Prompt and AutoAccept modes, a jump host key can therefore be stored for the target address. A machine later presenting the jump host key at the target address can be accepted as the target, allowing interception of user traffic and a newly issued certificate when certificate authentication is used. The native SSH path is unaffected because it tracks each hop separately. This issue is fixed in version 0.27.6.
- Database specific
{ "cna_assigner": "GitHub_M", "cwe_ids": [ "CWE-297", "CWE-923" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91166.json" }- References
-
- https://github.com/warp-tech/warpgate/releases/tag/v0.27.6
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91166.json
- https://github.com/warp-tech/warpgate/security/advisories/GHSA-w9jj-vpw3-5r8f
- https://nvd.nist.gov/vuln/detail/CVE-2026-91166
- https://github.com/warp-tech/warpgate/commit/fb66ff74f979c22054f4d348cc0d9065cc67e5d3
Affected packages
Git / github.com/warp-tech/warpgate
Affected ranges
- Type
- GIT
- Repo
- https://github.com/warp-tech/warpgate
- Events
- Database specific
-
Show details
{ "extracted_events": [ { "range": [ { "introduced": "0.25.0" }, { "fixed": "0.27.6" } ], "source": "AFFECTED_FIELD", "strategy": "StringRangeExpression" }, { "range": [ { "fixed": "fb66ff74f979c22054f4d348cc0d9065cc67e5d3" } ], "source": "REFERENCES_COMMIT" }, { "original_tag": "v0.27.6", "range": [ { "fixed": "3f166ef2fb27d3e6785df315fdc39914f0568404" } ], "source": "REFERENCES_TAG" } ] }