Warpgate is an open source bastion host supporting SSH, HTTPS, and MySQL. In versions from 0.23.0 up to but not including 0.27.3, the HTTP API token authentication mechanism resolves tokens into user authorization without enforcing the owning user's allowed_ip_ranges against the client's IP address. This flaw exists in the warpgate-protocol-http/src/common.rs component. As a result, an attacker possessing a leaked or stolen X-Warpgate-Token can use it from network locations that should be prohibited by IP restrictions. Deployments without allowed_ip_ranges configured are not affected. Other access paths such as SSH, MySQL, PostgreSQL, RDP, VNC, Kubernetes, and HTTP target proxying do not accept this vulnerable token flow. The issue is corrected in version 0.27.3.

An attacker who obtains a valid HTTP API token can bypass IP-based access restrictions if allowed_ip_ranges are configured, potentially gaining unauthorized access from prohibited network locations. The confidentiality impact is limited (partial information disclosure possible), with no integrity or availability impacts reported. Deployments without IP restrictions are unaffected. Other protocols and proxy paths are not vulnerable to this token misuse.

Upgrade warpgate to version 0.27.3 or later, where this improper access control issue is fixed. If upgrading immediately is not possible, consider disabling allowed_ip_ranges or restricting token distribution to trusted environments as a temporary measure. No other mitigations are documented. Patch status is confirmed fixed in 0.27.3.