CVE-2026-63329

Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.25.6, copy_server_request in warpgate-protocol-http/src/proxy.rs forwards a client-supplied x-warpgate-username header before inject_own_headers appends the authenticated username. Because the request builder preserves repeated values, a proxied backend that trusts the first x-warpgate-username value can authorize an authenticated attacker as another user. The same forwarding policy also accepts the reserved x-warpgate-authentication-type header, and warpgate-common/src/http_headers.rs does not exclude either reserved identity header. This issue is fixed in version 0.25.6.

CVSS v3 4.9 MEDIUM

4.9^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/warp-tech/warpgate/commit/c3748d7585209781b2d3a39ac9941b91d11d9b77
https://github.com/warp-tech/warpgate/releases/tag/v0.25.6
https://github.com/warp-tech/warpgate/security/advisories/GHSA-862h-v6cc-9757

Configurations

No configuration.

History

21 Sep 2026, 19:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-09-21 19:17

Updated : 2026-09-24 21:25

NVD link : CVE-2026-63329

Mitre link : CVE-2026-63329

CVE.ORG link : CVE-2026-63329

JSON object : View

Products Affected

No product.

CWE

CWE-116

Improper Encoding or Escaping of Output

CWE-290

Authentication Bypass by Spoofing

{"id": "CVE-2026-63329", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-63329", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-22T14:12:31.220504Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 4.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 1.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "warp-tech", "product": "warpgate", "versions": [{"status": "affected", "version": "< 0.25.6"}]}]}], "published": "2026-09-21T19:17:08.290", "references": [{"url": "https://github.com/warp-tech/warpgate/commit/c3748d7585209781b2d3a39ac9941b91d11d9b77", "source": "security-advisories@github.com"}, {"url": "https://github.com/warp-tech/warpgate/releases/tag/v0.25.6", "source": "security-advisories@github.com"}, {"url": "https://github.com/warp-tech/warpgate/security/advisories/GHSA-862h-v6cc-9757", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-116"}, {"lang": "en", "value": "CWE-290"}]}], "descriptions": [{"lang": "en", "value": "Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.25.6, copy_server_request in warpgate-protocol-http/src/proxy.rs forwards a client-supplied x-warpgate-username header before inject_own_headers appends the authenticated username. Because the request builder preserves repeated values, a proxied backend that trusts the first x-warpgate-username value can authorize an authenticated attacker as another user. The same forwarding policy also accepts the reserved x-warpgate-authentication-type header, and warpgate-common/src/http_headers.rs does not exclude either reserved identity header. This issue is fixed in version 0.25.6."}], "lastModified": "2026-09-24T21:25:27.050", "sourceIdentifier": "security-advisories@github.com"}