CVE-2026-44347 is a CSRF vulnerability in warp-tech's Warpgate open source bastion host for Linux. The issue arises because the SSO flow prior to version 0.23.3 does not validate the state parameter, enabling attackers to coerce users into authenticating into the attacker's account. This can lead to unauthorized sensitive actions being performed under the attacker's identity. The vulnerability has a CVSS 3.1 base score of 5.8, indicating medium severity. No official remediation level or patch link is provided in the data, but the issue is fixed starting with version 0.23.3.

An attacker can exploit this vulnerability to trick users into logging into the attacker's account, potentially causing users to perform sensitive actions such as writing data to the attacker's SSH target or logging into attacker-controlled HTTP targets. This can lead to unauthorized data manipulation or access under the attacker's control. There is no indication of confidentiality loss or availability impact, but integrity is affected.

Upgrade Warpgate to version 0.23.3 or later, where the vulnerability is fixed by proper validation of the state parameter in the SSO flow. Since no official patch link or advisory is provided, users should verify the version upgrade from the official warp-tech sources. Patch status is not explicitly confirmed beyond the version fix note, so check vendor advisories for the latest remediation guidance.