Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-91167

warpgate · Vulnerability

CVSS 4.0 6.0 MEDIUMCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-91167

Published

Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.28.4, PUT /@warpgate/admin/api/users/:id/roles/:role_id reaches api_update_user_role in warpgate-admin/src/api/users.rs through AdminContext but does not require AdminPermission::AccessRolesAssign. A limited administrator with any permission can update expires_at on an existing UserRoleAssignment and clear revoked_at, extending an expiring grant or reinstating a revoked grant. The endpoint cannot create a role assignment that never existed because it returns not found without a matching user and role pair. This issue is fixed in version 0.28.4.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-91167

Published

warpgate

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "warp-tech",
                    "product": "warpgate",
                    "versions": [
                        {
                            "version": "< 0.28.4",
                            "status": "affected"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON