{"id":"CVE-2026-91166","aliases":["EUVD-2026-84064","GHSA-w9jj-vpw3-5r8f"],"status":"published","title":"Warpgate: Web SSH stores a jump host's key against the target's address, so it validates as the target","description":"Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. From 0.25.0 until 0.27.6, the browser SSH path in warpgate-web-ssh/src/manager.rs handles RCEvent::HostKeyUnknown without the presenting hop identity and instead passes ssh_options.host and ssh_options.port for the final target to KnownHosts::trust. In Prompt and AutoAccept modes, a jump host key can therefore be stored for the target address. A machine later presenting the jump host key at the target address can be accepted as the target, allowing interception of user traffic and a newly issued certificate when certificate authentication is used. The native SSH path is unaffected because it tracks each hop separately. This issue is fixed in version 0.27.6.","severity":{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00218,"percentile":0.12352,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-297","CWE-923"],"published":"2026-09-21T18:53:56Z","modified":"2026-10-28T02:31:03Z","products":[{"vendor":"warp-tech","product":"warpgate"}],"references":[{"url":"https://github.com/warp-tech/warpgate/security/advisories/GHSA-w9jj-vpw3-5r8f","tags":["x_refsource_CONFIRM","exploit","advisory"]},{"url":"https://github.com/warp-tech/warpgate/commit/fb66ff74f979c22054f4d348cc0d9065cc67e5d3","tags":["x_refsource_MISC","fix"]},{"url":"https://github.com/warp-tech/warpgate/releases/tag/v0.27.6","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91166.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91166","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-91166","title":"Warpgate: Web SSH stores a jump host's key against the target's address, so it validates as the target","description":"Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. From 0.25.0 until 0.27.6, the browser SSH path in warpgate-web-ssh/src/manager.rs handles RCEvent::HostKeyUnknown without the presenting hop identity and instead passes ssh_options.host and ssh_options.port for the final target to KnownHosts::trust. In Prompt and AutoAccept modes, a jump host key can therefore be stored for the target address. A machine later presenting the jump host key at the target address can be accepted as the target, allowing interception of user traffic and a newly issued certificate when certificate authentication is used. The native SSH path is unaffected because it tracks each hop separately. This issue is fixed in version 0.27.6.","status":"published","published":"2026-09-21T18:53:56.224Z","modified":"2026-09-24T22:32:09.888Z","cvss":[{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-297","CWE-923"],"updated_at":"2026-11-02T14:19:53.115938Z"}],"euvd":[{"id":"EUVD-2026-84064","description":"Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. From 0.25.0 until 0.27.6, the browser SSH path in warpgate-web-ssh/src/manager.rs handles RCEvent::HostKeyUnknown without the presenting hop identity and instead passes ssh_options.host and ssh_options.port for the final target to KnownHosts::trust. In Prompt and AutoAccept modes, a jump host key can therefore be stored for the target address. A machine later presenting the jump host key at the target address can be accepted as the target, allowing interception of user traffic and a newly issued certificate when certificate authentication is used. The native SSH path is unaffected because it tracks each hop separately. This issue is fixed in version 0.27.6.","status":"published","published":"2026-09-21T18:53:56Z","modified":"2026-09-24T22:32:09Z","cvss":[{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T17:27:56.296478Z"}],"nvd":[{"id":"CVE-2026-91166","description":"Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. From 0.25.0 until 0.27.6, the browser SSH path in warpgate-web-ssh/src/manager.rs handles RCEvent::HostKeyUnknown without the presenting hop identity and instead passes ssh_options.host and ssh_options.port for the final target to KnownHosts::trust. In Prompt and AutoAccept modes, a jump host key can therefore be stored for the target address. A machine later presenting the jump host key at the target address can be accepted as the target, allowing interception of user traffic and a newly issued certificate when certificate authentication is used. The native SSH path is unaffected because it tracks each hop separately. This issue is fixed in version 0.27.6.","status":"published","published":"2026-09-21T19:17:15.383Z","modified":"2026-09-24T23:19:21.613Z","cvss":[{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-297","CWE-923"],"updated_at":"2026-11-02T14:12:50.368368Z"}],"osv":[{"id":"CVE-2026-91166","title":"Warpgate: Web SSH stores a jump host's key against the target's address, so it validates as the target","description":"Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. From 0.25.0 until 0.27.6, the browser SSH path in warpgate-web-ssh/src/manager.rs handles RCEvent::HostKeyUnknown without the presenting hop identity and instead passes ssh_options.host and ssh_options.port for the final target to KnownHosts::trust. In Prompt and AutoAccept modes, a jump host key can therefore be stored for the target address. A machine later presenting the jump host key at the target address can be accepted as the target, allowing interception of user traffic and a newly issued certificate when certificate authentication is used. The native SSH path is unaffected because it tracks each hop separately. This issue is fixed in version 0.27.6.","status":"published","published":"2026-09-21T18:53:56.224Z","modified":"2026-10-28T02:31:03.825031016Z","cvss":[{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N","level":"medium"}],"cwes":["CWE-297","CWE-923"],"updated_at":"2026-11-02T15:45:20.269367Z"}]}}