Executive brief
Warpgate is an open-source bastion host for managing SSH, HTTPS, and MySQL connections. A flaw in the web-based SSH client causes jump host keys to be incorrectly mapped to target server addresses. An attacker with access to a jump host's private key could intercept user traffic to target servers and potentially capture SSH certificates, compromising the security of multi-hop SSH connections.
Technical details
The browser SSH implementation in warpgate-web-ssh/src/manager.rs fails to track hop identity when handling RCEvent::HostKeyUnknown, storing the jump host key against the target's IP address and port instead. In Prompt and AutoAccept modes, this allows a machine presenting the jump host's key at the target address to be accepted as legitimate. The native SSH client is unaffected because it correctly tracks each hop separately. The fix adds hop identity parameters to prevent key confusion.
Affected products
- warp-tech Warpgate 0.25.0 to 0.27.5
Timeline
- 2026-09-21: disclosed: CVE-2026-91166 published
- 2026-08-15: patched: Fix committed to main branch
- 2026-08-14: patched: Version 0.27.6 released