Warp-tech Warpgate vulnerabilities

• warp-tech warpgate Warpgate: Kubernetes listener discloses internal error text to an unauthenticated caller CVE-2026-91163 3.7 LowNovember 4, 2026
• warp-tech warpgate Warpgate: Kubernetes authorization correlation can be reused by a recreated same-name account CVE-2026-91168 6.8 MediumNovember 4, 2026
• warp-tech warpgate Warpgate: Missing authorization check on `PUT /users/:id/roles/:role_id` allows any admin to bypass the `AccessRolesAssign` permission boundary CVE-2026-91167 6.0 MediumSeptember 21, 2026
• warp-tech warpgate Warpgate: Web SSH stores a jump host's key against the target's address, so it validates as the target CVE-2026-91166 5.7 MediumSeptember 21, 2026
• warp-tech warpgate Warpgate: Markup injection in SSO form_post return page via unencoded redirect/error values CVE-2026-91165 2.4 LowSeptember 21, 2026
• warp-tech warpgate Warpgate: API tokens bypass the user's allowed_ip_ranges restriction CVE-2026-91164 4.3 MediumSeptember 21, 2026
• warp-tech warpgate Warpgate: Missing Admin Authorization on Live Recording Stream WebSocket Allows Any Authenticated User to Eavesdrop on Terminal Sessions CVE-2026-63330 7.7 HighSeptember 21, 2026
• warp-tech warpgate Warpgate: x-warpgate-username Header Not Stripped from Client Requests Enables Identity Spoofing to WebSocket Backend Targets CVE-2026-63329 4.9 MediumSeptember 21, 2026
• warp-tech warpgate Warpgate: Reflected XSS in SSO return endpoint via attacker-controlled next parameter CVE-2026-58491 9.3 CriticalSeptember 21, 2026
• warp-tech warpgate Warpgate: SSO CSRF -- State Token Not Validated on Return CVE-2026-44347 5.8 MediumMay 12, 2026
• warp-tech warpgate User authorization bug leading to privilege escalation in warpgate CVE-2023-48712 7.1 HighNovember 24, 2023
• warp-tech warpgate SSH key password bypassed in warpgate CVE-2023-43660 4.8 MediumSeptember 27, 2023
• warp-tech warpgate User login confusion with SSO in warpgate CVE-2023-37268 6.4 MediumJuly 14, 2023