CVE-2026-91164: Warpgate: API tokens bypass the user's allowed_ip_ranges restriction
Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. From 0.23.0 until 0.27.3, HTTP API token authentication resolves ConfigProvider::validateapitoken into RequestAuthorization::UserToken without enforcing the owning user's allowedipranges against the trusted client address in warpgate-protocol-http/src/common.rs. An attacker holding a leaked, phished, or exfiltrated X-Warpgate-Token can therefore use it from a prohibited network location. Deployments without allowedipranges are unaffected, and HTTP target proxying plus SSH, MySQL, PostgreSQL, RDP, VNC, and Kubernetes paths do not accept this vulnerable HTTP token flow. This issue is fixed in version 0.27.3.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
warpgateto a version that resolves this vulnerability.Fixed in 0.27.3
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Only Warpgate deployments using versions 0.23.0 through 0.27.3 that configure allowed_ip_ranges for users are affected. Deployments without allowed_ip_ranges are unaffected.
What does an attacker need to exploit the bypass?
An attacker needs a valid X-Warpgate-Token belonging to a user whose allowed_ip_ranges would otherwise restrict the attacker's network location. The token could be leaked, phished, or exfiltrated.
Which access paths are affected?
The issue is limited to HTTP API token authentication. HTTP target proxying and the SSH, MySQL, PostgreSQL, RDP, VNC, and Kubernetes paths do not accept the vulnerable HTTP token flow.
How can the issue be remediated?
Upgrade Warpgate to version 0.27.3, which fixes the missing allowed_ip_ranges enforcement for HTTP API token authentication.