warp-tech warpgate vulnerabilities

CVEs per yearBy the year they were published

1. 20233
2. 202610

Newest CVEs

• CVE-2026-91163

  Warpgate: Kubernetes listener discloses internal error text to an unauthenticated caller

  warp-tech · warpgate

  Low3.7
• CVE-2026-91168

  Warpgate: Kubernetes authorization correlation can be reused by a recreated same-name account

  warp-tech · warpgate

  Medium6.8
• CVE-2026-91167

  Warpgate: Missing authorization check on `PUT /users/:id/roles/:role_id` allows any admin to bypass the `AccessRolesAssign` permission boundary

  warp-tech · warpgate

  Medium6.0
• CVE-2026-91166

  Warpgate: Web SSH stores a jump host's key against the target's address, so it validates as the target

  warp-tech · warpgate

  Medium5.7
• CVE-2026-91165

  Warpgate: Markup injection in SSO form_post return page via unencoded redirect/error values

  warp-tech · warpgate

  Low2.4
• CVE-2026-91164

  Warpgate: API tokens bypass the user's allowed_ip_ranges restriction

  warp-tech · warpgate

  Medium4.3
• CVE-2026-63330

  Warpgate: Missing Admin Authorization on Live Recording Stream WebSocket Allows Any Authenticated User to Eavesdrop on Terminal Sessions

  warp-tech · warpgate

  High7.7
• CVE-2026-63329

  Warpgate: x-warpgate-username Header Not Stripped from Client Requests Enables Identity Spoofing to WebSocket Backend Targets

  warp-tech · warpgate

  Medium4.9
• CVE-2026-58491

  Warpgate: Reflected XSS in SSO return endpoint via attacker-controlled next parameter

  warp-tech · warpgate

  Critical9.3
• CVE-2026-44347

  Warpgate: SSO CSRF -- State Token Not Validated on Return

  warp-tech · warpgate

  Medium5.8