Executive brief
Warpgate is an open-source bastion host that proxies SSH, HTTPS, and MySQL connections. An authenticated attacker can forge HTTP headers (x-warpgate-username and x-warpgate-authentication-type) to impersonate other users when the proxied backend trusts these headers for authentication. This allows account takeover or lateral movement within networked systems.
Technical details
The vulnerability exists in warpgate-protocol-http/src/proxy.rs where copy_server_request forwards client-supplied x-warpgate-username and x-warpgate-authentication-type headers before authenticated headers are appended. Request builders that preserve duplicate header values allow an authenticated attacker to inject identity headers that override authentication. The fix in v0.25.6 restricts reserved header forwarding in warpgate-common/src/http_headers.rs.
Affected products
- warp-tech Warpgate before 0.25.6
Timeline
- 2026-09-21: disclosed
- 2026-06-30: patched