CVE-2026-91166: CWE-297: Improper Validation of Certificate with Host Mismatch in warp-tech warpgate
Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. From 0.25.0 until 0.27.6, the browser SSH path in warpgate-web-ssh/src/manager.rs handles RCEvent::HostKeyUnknown without the presenting hop identity and instead passes ssh_options.host and ssh_options.port for the final target to KnownHosts::trust. In Prompt and AutoAccept modes, a jump host key can therefore be stored for the target address. A machine later presenting the jump host key at the target address can be accepted as the target, allowing interception of user traffic and a newly issued certificate when certificate authentication is used. The native SSH path is unaffected because it tracks each hop separately. This issue is fixed in version 0.27.6.
AI Analysis
Technical Summary
Warpgate, an open source SSH, HTTPS, and MySQL bastion host for Linux, versions >=0.25.0 and <0.27.6 contain a vulnerability in the browser SSH path implementation. Specifically, the handling of RCEvent::HostKeyUnknown in warpgate-web-ssh/src/manager.rs does not present the hop identity and instead passes the final target's host and port to KnownHosts::trust. In Prompt and AutoAccept modes, this causes a jump host key to be stored as the target host key. Consequently, a machine presenting the jump host key at the target address can be accepted as the legitimate target, enabling interception of user traffic and issuance of a new certificate during certificate authentication. The native SSH path is unaffected because it tracks each hop separately. The vulnerability is addressed in warpgate version 0.27.6.
Potential Impact
An attacker controlling a jump host key can impersonate the target host in the browser SSH path, allowing interception of user traffic and issuance of new certificates during certificate authentication. This compromises confidentiality and integrity of communications. The native SSH path is not vulnerable. There are no known exploits in the wild.
Mitigation Recommendations
Upgrade warpgate to version 0.27.6 or later, where this issue is fixed. No other mitigations are indicated.
CVE-2026-91166: CWE-297: Improper Validation of Certificate with Host Mismatch in warp-tech warpgate
Description
Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. From 0.25.0 until 0.27.6, the browser SSH path in warpgate-web-ssh/src/manager.rs handles RCEvent::HostKeyUnknown without the presenting hop identity and instead passes ssh_options.host and ssh_options.port for the final target to KnownHosts::trust. In Prompt and AutoAccept modes, a jump host key can therefore be stored for the target address. A machine later presenting the jump host key at the target address can be accepted as the target, allowing interception of user traffic and a newly issued certificate when certificate authentication is used. The native SSH path is unaffected because it tracks each hop separately. This issue is fixed in version 0.27.6.
CVSS v3.1
Score 5.7medium
Affected software
warp-tech
warpgate
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Warpgate, an open source SSH, HTTPS, and MySQL bastion host for Linux, versions >=0.25.0 and <0.27.6 contain a vulnerability in the browser SSH path implementation. Specifically, the handling of RCEvent::HostKeyUnknown in warpgate-web-ssh/src/manager.rs does not present the hop identity and instead passes the final target's host and port to KnownHosts::trust. In Prompt and AutoAccept modes, this causes a jump host key to be stored as the target host key. Consequently, a machine presenting the jump host key at the target address can be accepted as the legitimate target, enabling interception of user traffic and issuance of a new certificate during certificate authentication. The native SSH path is unaffected because it tracks each hop separately. The vulnerability is addressed in warpgate version 0.27.6.
Potential Impact
An attacker controlling a jump host key can impersonate the target host in the browser SSH path, allowing interception of user traffic and issuance of new certificates during certificate authentication. This compromises confidentiality and integrity of communications. The native SSH path is not vulnerable. There are no known exploits in the wild.
Mitigation Recommendations
Upgrade warpgate to version 0.27.6 or later, where this issue is fixed. No other mitigations are indicated.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-09-14T21:20:41.196Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6ab17f3e55bf5e2cf554e7c1
Added to database: 09/21/2026, 19:02:22 UTC
Last enriched: 09/21/2026, 19:17:15 UTC
Last updated: 09/22/2026, 00:46:32 UTC
Views: 8
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.