Security Flaw in Warpgate Open Source Bastion Host for Linux

CVE-2026-91163

What is CVE-2026-91163?

Warpgate, an open source bastion host for Linux, is vulnerable due to improper handling of TLS certificate validation in its Kubernetes protocol listener. Prior to version 0.29.0, the listener utilized AcceptAnyClientCert, leading to potential disclosure of internal error information when an unauthenticated network client triggers failures. The lack of effective request logging mechanisms allowed attackers to receive detailed diagnostic messages and database errors without being recorded in the logs. This could enable threat actors to exploit the system more effectively. The issue was resolved in version 0.29.0.

References