Executive brief
Warpgate is an open-source bastion host that controls and logs SSH, HTTPS, and database connections. Prior to version 0.25.6, an authenticated user with regular permissions could eavesdrop on other users' active terminal sessions in real time, including capturing credentials, commands, and sensitive data belonging to other employees and administrators.
Technical details
The api_get_recording_stream API endpoint in warpgate-admin/src/api/recordings_detail.rs enforces only session authentication and omits the required AdminPermission::RecordingsView check. An authenticated regular user can subscribe to a WebSocket feed of an active recording UUID to receive real-time terminal input/output from proxied SSH, MySQL, or PostgreSQL sessions. The vulnerability was fixed by adding the missing permission check in version 0.25.6.
Affected products
- Warp Tech Warpgate prior to 0.25.6
Timeline
- 2026-09-21: disclosed
- 2026-06-30: patched: Fixed in version 0.25.6