Is CVE-2026-58491 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-58491 being exploited in the wild.

How severe is CVE-2026-58491?

Critical severity, with a CVSS score of 9.3, published 21 September 2026.

Which products and versions are affected?

Warp Tech Warpgate before 0.25.5.

Is there a fix for CVE-2026-58491?

A patch was published on 2026-06-18: Version 0.25.5 released with HTML escaping fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-58491 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-58491?

Check whether you run Warp Tech Warpgate at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-58491: Warpgate cross-site scripting and open redirect in SSO handler

CVE-2026-58491 · Severity: critical · CVSS 9.3 · Published 2026-09-21

Warpgate is an open source bastion host that provides centralized access control for SSH, HTTPS, and MySQL connections. An attacker can craft a malicious login URL that, when clicked by a victim who completes single sign-on, executes JavaScript in the authenticated Warpgate session or redirects to an attacker-controlled site. This allows attackers to steal session credentials, impersonate users, or perform unauthorized administrative actions.

Technologies: Warp Tech Warpgate. Vendors: Warp Tech.

Quick answers

Is CVE-2026-58491 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-58491 being exploited in the wild.
How severe is CVE-2026-58491?: Critical severity, with a CVSS score of 9.3, published 21 September 2026.
Which products and versions are affected?: Warp Tech Warpgate before 0.25.5.
Is there a fix for CVE-2026-58491?: A patch was published on 2026-06-18: Version 0.25.5 released with HTML escaping fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-58491 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-58491?: Check whether you run Warp Tech Warpgate at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a stored cross-site scripting (XSS) and open redirect flaw in the SSO endpoints. The /@warpgate/api/sso/providers/:name/start endpoint stores an attacker-controlled "next" parameter, which is later inserted without HTML escaping into responses generated by the SSO return handler in warpgate-protocol-http/src/api/sso_provider_list.rs. An unauthenticated attacker can craft a link containing malicious JavaScript, and when an authenticated user follows it, the code executes in their browser with access to user and (if applicable) administrator APIs.

Affected products

Warp Tech Warpgate before 0.25.5

Timeline

2026-09-21: disclosed
2026-06-18: patched: Version 0.25.5 released with HTML escaping fix

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.