Authorization Bypass in Warpgate by Warp Tech
CVE-2026-91168

6.8MEDIUM

Key Information:

Vendor

Warp-tech

Status
Warpgate
Vendor
CVE Published:
4 November 2026

What is CVE-2026-91168?

A vulnerability in Warpgate allows for authorization bypass due to improper user identification in the Kubernetes request correlator. In versions 0.21.0 to 0.29.0, when a user account is deleted and another account is created with the same username, the new account can exploit an existing correlation entry. This can lead to unauthorized access to Kubernetes resources via the proxy functionality, enabling actions that the new account should not be permitted to execute. The issue has been addressed in version 0.29.0.

Affected Version(s)

warpgate >= 0.21.0, < 0.29.0

References

https://github.com/warp-tech/warpgate/security/advisories...
x_refsource_CONFIRM
https://github.com/warp-tech/warpgate/commit/2f77f07b8335...
x_refsource_MISC
https://github.com/warp-tech/warpgate/releases/tag/v0.29.0
x_refsource_MISC

CVSS V3.1

Score:
6.8
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.