CVE-2026-63330 in Warpgate
Summary
by MITRE • 09/21/2026
Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.25.6, api_get_recording_stream in warpgate-admin/src/api/recordings_detail.rs protects /@warpgate/admin/api/recordings/{uuid}/stream only with session authentication and omits require_admin_permission for AdminPermission::RecordingsView. Any authenticated regular user who identifies an active recording can subscribe to its WebSocket and receive real-time terminal input and output from proxied SSH, MySQL, or PostgreSQL sessions, including credentials, commands, and other sensitive data belonging to users and administrators. This issue is fixed in version 0.25.6.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/21/2026
The vulnerability identified as a critical authorization flaw within Warpgate versions prior to 0.25.6 stems from an insufficient access control mechanism on the recording stream endpoint. Warpgate functions as an open-source bastion host facilitating SSH, HTTPS, and MySQL connections for Linux environments, providing audit trails through session recordings. The specific weakness resides in the api_get_recording_stream function located within the warpgate-admin/src/api/recordings_detail.rs module. This endpoint is designed to serve real-time terminal input and output from proxied sessions via a WebSocket connection. However, the implementation relied exclusively on standard session authentication to protect this resource, failing to enforce an additional administrative permission check for viewing recordings.
From a technical perspective, the flaw represents a classic case of broken access control where role-based permissions are not correctly validated against the requested action. The endpoint /@warpgate/admin/api/recordings/{uuid}/stream was intended to be restricted to administrators possessing the AdminPermission::RecordingsView privilege. Instead, any authenticated user with valid session credentials could interact with this API if they possessed or guessed a valid recording UUID associated with an active session. This architectural oversight allows non-administrative users to bypass security boundaries that are meant to segregate sensitive audit data from general operational access.
The operational impact of this vulnerability is severe due to the nature of bastion host recordings. These streams contain real-time terminal input and output, which inherently includes plaintext credentials, executed commands, database queries, and other highly sensitive organizational data belonging to both regular users and administrators. An attacker exploiting this flaw could subscribe to these WebSocket connections and intercept live session data in transit. This capability effectively neutralizes the primary security benefit of a bastion host, which is centralized monitoring and secure credential management, thereby exposing the organization to significant risks including unauthorized access to downstream systems, intellectual property theft, and compliance violations related to data privacy regulations such as GDPR or HIPAA depending on the jurisdiction and industry sector.
This vulnerability aligns with CWE-269, Improper Privilege Assignment, specifically where a user is granted privileges that they should not possess for the specific resource accessed. Furthermore, in terms of offensive security frameworks, this exploitation technique corresponds to ATT&CK T1078, Valid Accounts, as it leverages legitimate authentication credentials to access unauthorized resources, and potentially T1539, Steal Web Session Cookie, if session tokens are intercepted during the WebSocket handshake or subsequent data transmission. The lack of proper authorization checks on a sensitive administrative function allows for lateral movement within the organization's infrastructure by exposing internal network details and service configurations embedded in terminal sessions.
To mitigate this vulnerability, organizations running Warpgate must immediately upgrade to version 0.25.6 or later, where the code has been patched to enforce the AdminPermission::RecordingsView requirement on the recording stream endpoint. Until an upgrade is feasible, administrators should implement network-level access controls such as firewall rules that restrict access to the Warpgate administrative interface exclusively from trusted management subnets. Additionally, enabling strict logging and monitoring for unusual WebSocket connection attempts or high-frequency requests to the recordings API can help detect potential exploitation activities in real-time. It is also recommended to review existing session recording policies to ensure that sensitive data handling complies with organizational security standards while waiting for the patch deployment.