Is CVE-2026-91168 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-91168 being exploited in the wild.

How severe is CVE-2026-91168?

Medium severity, with a CVSS score of 6.8, published 4 November 2026.

Which products and versions are affected?

Warp Tech Warpgate 0.21.0 to 0.28.x.

Is there a fix for CVE-2026-91168?

Yes: fixed in 0.29.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-91168 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-91168?

Check whether you run Warp Tech Warpgate at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-91168: Warpgate Kubernetes session reuse in recreated account

CVE-2026-91168 · Severity: medium · CVSS 6.8 · Published 2026-11-04

Warpgate is an open source bastion host that proxies SSH, HTTPS, and MySQL access to protected servers and Kubernetes clusters. If a user account is deleted and recreated with the same username, the recreated account can reuse stale Kubernetes session correlations from the deleted account, allowing it to access Kubernetes targets that the new account is not authorized to use. This could expose cluster resources or permit unauthorized changes to Kubernetes infrastructure.

Technologies: Warp Tech Warpgate. Vendors: Warp Tech.

Quick answers

Is CVE-2026-91168 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-91168 being exploited in the wild.
How severe is CVE-2026-91168?: Medium severity, with a CVSS score of 6.8, published 4 November 2026.
Which products and versions are affected?: Warp Tech Warpgate 0.21.0 to 0.28.x.
Is there a fix for CVE-2026-91168?: Yes: fixed in 0.29.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-91168 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-91168?: Check whether you run Warp Tech Warpgate at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 0.29.0

Technical details

The Kubernetes request correlator keyed session correlations by username, target name, and client IP rather than by immutable user UUID; when accounts were deleted, the correlation cache entries were not evicted. An attacker who obtains a recreated username can bypass target authorization checks by reusing a predecessor's live correlation entry, accessing Kubernetes credentials the new account lacks permission for. The fix changes the correlation key to use user UUID instead of username.

Affected products

Warp Tech Warpgate 0.21.0 to 0.28.x

Timeline

2026-11-04: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.