Executive brief
Warpgate is an open-source bastion host that controls remote access to servers via SSH, HTTPS, MySQL, and other protocols. In affected versions, an attacker who obtains a leaked or stolen API authentication token can use it from any network location, bypassing the administrator's IP restrictions. This allows unauthorized remote access to protected systems from prohibited networks.
Technical details
The HTTP API token validation in Warpgate 0.23.0–0.27.2 fails to enforce the allowed_ip_ranges restriction when processing X-Warpgate-Token headers in the HTTP endpoint. The vulnerability exists in warpgate-protocol-http/src/common.rs where ConfigProvider::validate_api_token resolves tokens without checking whether the client's source IP is within the owner's allowed ranges. Other protocol paths (SSH, MySQL, PostgreSQL, RDP, VNC, Kubernetes) and HTTP target proxying are unaffected. Deployments without configured IP range restrictions are not impacted.
Affected products
- Warp Warpgate 0.23.0 to 0.27.2
Timeline
- 2026-09-21: disclosed