Open Source SSH and HTTPS Bastion Host Vulnerability in Warpgate by Warp Tech

CVE-2026-58491

What is CVE-2026-58491?

Warpgate, an open-source SSH, HTTPS, and MySQL bastion host for Linux, is affected by a vulnerability in the /@warpgate/api/sso/providers/:name/start endpoint. This endpoint improperly handles an attacker-controlled parameter, allowing the POST /@warpgate/api/sso/return handler to insert this unvalidated value directly into the server response without proper HTML escaping. Consequently, this allows attackers to execute arbitrary markup and JavaScript within the authenticated Warpgate session, potentially compromising sensitive session data and user API interactions. Furthermore, if the victim is an administrator, the risk extends to administrator API access. The vulnerability also enables an open redirect through the GET /@warpgate/api/sso/return path, leveraging the same unvalidated parameter. Users are advised to upgrade to version 0.25.5 or later, where this issue has been resolved.

References