CVE-2026-63330: Warpgate: Missing Admin Authorization on Live Recording Stream WebSocket Allows Any Authenticated User to Eavesdrop on Terminal Sessions
Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.25.6, apigetrecordingstream in warpgate-admin/src/api/recordingsdetail.rs protects /@warpgate/admin/api/recordings/{uuid}/stream only with session authentication and omits requireadminpermission for AdminPermission::RecordingsView. Any authenticated regular user who identifies an active recording can subscribe to its WebSocket and receive real-time terminal input and output from proxied SSH, MySQL, or PostgreSQL sessions, including credentials, commands, and other sensitive data belonging to users and administrators. This issue is fixed in version 0.25.6.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
warpgateto a version that resolves this vulnerability.Fixed in 0.25.6
Event History
Frequently Asked Questions
Which deployments are exposed?
Warpgate deployments running versions prior to 0.25.6 are exposed if authenticated regular users can access the affected recording-stream endpoint and identify an active recording.
What does an attacker need to exploit this issue?
An attacker needs a valid authenticated Warpgate user session and the identifier of an active recording. No administrator permission is required on affected versions.
What information can be exposed?
An unauthorized user can subscribe to the live recording WebSocket and receive real-time terminal input and output from proxied SSH, MySQL, or PostgreSQL sessions. Exposed content can include credentials, commands, and other sensitive session data.
How can this be remediated?
Upgrade Warpgate to version 0.25.6, which adds the missing authorization check for viewing recordings.