CVE-2026-44347

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-44347", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-05T19:52:59.148Z", "datePublished": "2026-05-12T22:44:17.831Z", "dateUpdated": "2026-05-13T15:36:43.539Z"}, "containers": {"cna": {"title": "Warpgate: SSO CSRF -- State Token Not Validated on Return", "problemTypes": [{"descriptions": [{"cweId": "CWE-352", "lang": "en", "description": "CWE-352: Cross-Site Request Forgery (CSRF)", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:H/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/warp-tech/warpgate/security/advisories/GHSA-rj86-hm3r-c275", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/warp-tech/warpgate/security/advisories/GHSA-rj86-hm3r-c275"}], "affected": [{"vendor": "warp-tech", "product": "warpgate", "versions": [{"version": "< 0.23.3", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-12T22:44:17.831Z"}, "descriptions": [{"lang": "en", "value": "Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.23.3, the SSO flow does not validate the state parameter, which makes it possible for an attacker to trick a user into logging into the attacker's account, possibly convincing them to perform sensitive actions on the attacker's account (such as writing sensitive data to the attacker's SSH target, or logging into an HTTP target that the attacker set up). This vulnerability is fixed in 0.23.3."}], "source": {"advisory": "GHSA-rj86-hm3r-c275", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/warp-tech/warpgate/security/advisories/GHSA-rj86-hm3r-c275", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-13T15:35:20.915504Z", "id": "CVE-2026-44347", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-13T15:36:43.539Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-44347", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-13T15:35:20.915504Z"}}}], "references": [{"url": "https://github.com/warp-tech/warpgate/security/advisories/GHSA-rj86-hm3r-c275", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-13T15:35:29.779Z"}}], "cna": {"title": "Warpgate: SSO CSRF -- State Token Not Validated on Return", "source": {"advisory": "GHSA-rj86-hm3r-c275", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "warp-tech", "product": "warpgate", "versions": [{"status": "affected", "version": "< 0.23.3"}]}], "references": [{"url": "https://github.com/warp-tech/warpgate/security/advisories/GHSA-rj86-hm3r-c275", "name": "https://github.com/warp-tech/warpgate/security/advisories/GHSA-rj86-hm3r-c275", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.23.3, the SSO flow does not validate the state parameter, which makes it possible for an attacker to trick a user into logging into the attacker's account, possibly convincing them to perform sensitive actions on the attacker's account (such as writing sensitive data to the attacker's SSH target, or logging into an HTTP target that the attacker set up). This vulnerability is fixed in 0.23.3."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-352", "description": "CWE-352: Cross-Site Request Forgery (CSRF)"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-12T22:44:17.831Z"}}}, "cveMetadata": {"cveId": "CVE-2026-44347", "state": "PUBLISHED", "dateUpdated": "2026-05-13T15:36:43.539Z", "dateReserved": "2026-05-05T19:52:59.148Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-05-12T22:44:17.831Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "warpgate", "vendor": "warp-tech", "versions": [{"status": "affected", "version": "< 0.23.3"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:warpgate_project:warpgate:0.23.2:*:*:*:*:*:*:*", "matchCriteriaId": "E68A6FF7-C054-41E4-84A7-ECE25E0DBE19", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.23.3, the SSO flow does not validate the state parameter, which makes it possible for an attacker to trick a user into logging into the attacker's account, possibly convincing them to perform sensitive actions on the attacker's account (such as writing sensitive data to the attacker's SSH target, or logging into an HTTP target that the attacker set up). This vulnerability is fixed in 0.23.3."}, {"lang": "es", "value": "Warpgate es un host basti\u00f3n de c\u00f3digo abierto SSH, HTTPS y MySQL para Linux. Antes de la versi\u00f3n 0.23.3, el flujo de SSO no valida el par\u00e1metro state, lo que hace posible que un atacante enga\u00f1e a un usuario para que inicie sesi\u00f3n en la cuenta del atacante, posiblemente convenci\u00e9ndolos de realizar acciones sensibles en la cuenta del atacante (como escribir datos sensibles en el objetivo SSH del atacante, o iniciar sesi\u00f3n en un objetivo HTTP que el atacante configur\u00f3). Esta vulnerabilidad est\u00e1 corregida en la versi\u00f3n 0.23.3."}], "id": "CVE-2026-44347", "lastModified": "2026-10-26T18:10:00.173", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 1.3, "impactScore": 4.0, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-44347", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-05-13T15:35:20.915504Z", "version": "2.0.3"}}]}, "published": "2026-05-12T23:16:18.340", "references": [{"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/warp-tech/warpgate/security/advisories/GHSA-rj86-hm3r-c275"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/warp-tech/warpgate/security/advisories/GHSA-rj86-hm3r-c275"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,0.23.3)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "warpgate", "source": "cna", "vendor": "warp-tech"}, "product": "warpgate", "vendor": "warp-tech"}], "created": "2026-05-13T00:30:28.394271+00:00", "updated": "2026-05-13T10:35:12.895586+00:00", "vendors": ["warp-tech", "warp-tech$PRODUCT$warpgate"]}