CVE-2026-91163

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-91163", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-09-14T21:20:41.196Z", "datePublished": "2026-11-04T15:19:15.511Z", "dateUpdated": "2026-11-09T16:29:36.575Z"}, "containers": {"cna": {"title": "Warpgate: Kubernetes listener discloses internal error text to an unauthenticated caller", "problemTypes": [{"descriptions": [{"cweId": "CWE-209", "lang": "en", "description": "CWE-209: Generation of Error Message Containing Sensitive Information", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-532", "lang": "en", "description": "CWE-532: Insertion of Sensitive Information into Log File", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.7, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/warp-tech/warpgate/security/advisories/GHSA-hrfx-fm67-gv64", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/warp-tech/warpgate/security/advisories/GHSA-hrfx-fm67-gv64"}, {"name": "https://github.com/warp-tech/warpgate/pull/2547", "tags": ["x_refsource_MISC"], "url": "https://github.com/warp-tech/warpgate/pull/2547"}, {"name": "https://github.com/warp-tech/warpgate/commit/8426196a27c30fca521656653f9df1faf3df7523", "tags": ["x_refsource_MISC"], "url": "https://github.com/warp-tech/warpgate/commit/8426196a27c30fca521656653f9df1faf3df7523"}, {"name": "https://github.com/warp-tech/warpgate/releases/tag/v0.29.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/warp-tech/warpgate/releases/tag/v0.29.0"}], "affected": [{"vendor": "warp-tech", "product": "warpgate", "versions": [{"version": "< 0.29.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-11-04T15:19:15.511Z"}, "descriptions": [{"lang": "en", "value": "Warpgate is an open source SSH, HTTPS, and MySQL bastion host for Linux. Prior to 0.29.0, the Kubernetes protocol listener uses AcceptAnyClientCert in warpgate-protocol-kubernetes/src/server/client_certs.rs to accept certificates at the TLS layer and defer validation to warpgate-protocol-kubernetes/src/server/auth.rs, where authentication and lookup failures are rendered verbatim in an HTTP 500 response body. The Kubernetes application in warpgate-protocol-kubernetes/src/server/mod.rs lacks the outer request-logging wrapper used by the HTTP protocol, and failures in warpgate-protocol-kubernetes/src/server/handlers.rs can short-circuit before its inner log point. An unauthenticated network client can therefore induce failures and receive ASN.1/DER parser diagnostics or sea_orm database errors without the attempt being recorded in the gateway log. The disclosed information is limited to internal diagnostics, and no user-data, integrity, or availability impact is established. This issue is fixed in version 0.29.0."}], "source": {"advisory": "GHSA-hrfx-fm67-gv64", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/warp-tech/warpgate/security/advisories/GHSA-hrfx-fm67-gv64", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-09T16:29:19.384610Z", "id": "CVE-2026-91163", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-09T16:29:36.575Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-91163", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-09T16:29:19.384610Z"}}}], "references": [{"url": "https://github.com/warp-tech/warpgate/security/advisories/GHSA-hrfx-fm67-gv64", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-09T16:29:29.710Z"}}], "cna": {"title": "Warpgate: Kubernetes listener discloses internal error text to an unauthenticated caller", "source": {"advisory": "GHSA-hrfx-fm67-gv64", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.7, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "warp-tech", "product": "warpgate", "versions": [{"status": "affected", "version": "< 0.29.0"}]}], "references": [{"url": "https://github.com/warp-tech/warpgate/security/advisories/GHSA-hrfx-fm67-gv64", "name": "https://github.com/warp-tech/warpgate/security/advisories/GHSA-hrfx-fm67-gv64", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/warp-tech/warpgate/pull/2547", "name": "https://github.com/warp-tech/warpgate/pull/2547", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/warp-tech/warpgate/commit/8426196a27c30fca521656653f9df1faf3df7523", "name": "https://github.com/warp-tech/warpgate/commit/8426196a27c30fca521656653f9df1faf3df7523", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/warp-tech/warpgate/releases/tag/v0.29.0", "name": "https://github.com/warp-tech/warpgate/releases/tag/v0.29.0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Warpgate is an open source SSH, HTTPS, and MySQL bastion host for Linux. Prior to 0.29.0, the Kubernetes protocol listener uses AcceptAnyClientCert in warpgate-protocol-kubernetes/src/server/client_certs.rs to accept certificates at the TLS layer and defer validation to warpgate-protocol-kubernetes/src/server/auth.rs, where authentication and lookup failures are rendered verbatim in an HTTP 500 response body. The Kubernetes application in warpgate-protocol-kubernetes/src/server/mod.rs lacks the outer request-logging wrapper used by the HTTP protocol, and failures in warpgate-protocol-kubernetes/src/server/handlers.rs can short-circuit before its inner log point. An unauthenticated network client can therefore induce failures and receive ASN.1/DER parser diagnostics or sea_orm database errors without the attempt being recorded in the gateway log. The disclosed information is limited to internal diagnostics, and no user-data, integrity, or availability impact is established. This issue is fixed in version 0.29.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-209", "description": "CWE-209: Generation of Error Message Containing Sensitive Information"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-532", "description": "CWE-532: Insertion of Sensitive Information into Log File"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-11-04T15:19:15.511Z"}}}, "cveMetadata": {"cveId": "CVE-2026-91163", "state": "PUBLISHED", "dateUpdated": "2026-11-09T16:29:36.575Z", "dateReserved": "2026-09-14T21:20:41.196Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-11-04T15:19:15.511Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "warpgate", "vendor": "warp-tech", "versions": [{"status": "affected", "version": "< 0.29.0"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Warpgate is an open source SSH, HTTPS, and MySQL bastion host for Linux. Prior to 0.29.0, the Kubernetes protocol listener uses AcceptAnyClientCert in warpgate-protocol-kubernetes/src/server/client_certs.rs to accept certificates at the TLS layer and defer validation to warpgate-protocol-kubernetes/src/server/auth.rs, where authentication and lookup failures are rendered verbatim in an HTTP 500 response body. The Kubernetes application in warpgate-protocol-kubernetes/src/server/mod.rs lacks the outer request-logging wrapper used by the HTTP protocol, and failures in warpgate-protocol-kubernetes/src/server/handlers.rs can short-circuit before its inner log point. An unauthenticated network client can therefore induce failures and receive ASN.1/DER parser diagnostics or sea_orm database errors without the attempt being recorded in the gateway log. The disclosed information is limited to internal diagnostics, and no user-data, integrity, or availability impact is established. This issue is fixed in version 0.29.0."}], "id": "CVE-2026-91163", "lastModified": "2026-11-09T17:17:33.993", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.7, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-91163", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-09T16:29:19.384610Z", "version": "2.0.3"}}]}, "published": "2026-11-04T16:17:54.543", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/warp-tech/warpgate/commit/8426196a27c30fca521656653f9df1faf3df7523"}, {"source": "security-advisories@github.com", "url": "https://github.com/warp-tech/warpgate/pull/2547"}, {"source": "security-advisories@github.com", "url": "https://github.com/warp-tech/warpgate/releases/tag/v0.29.0"}, {"source": "security-advisories@github.com", "url": "https://github.com/warp-tech/warpgate/security/advisories/GHSA-hrfx-fm67-gv64"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/warp-tech/warpgate/security/advisories/GHSA-hrfx-fm67-gv64"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-209"}, {"lang": "en", "value": "CWE-532"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "warpgate: Warpgate: Information disclosure via verbose error responses in Kubernetes listener", "id": "2567818", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2567818"}, "csaw": false, "cvss3": {"cvss3_base_score": "3.7", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "status": "draft"}, "cwe": "CWE-209", "details": ["Warpgate is an open source SSH, HTTPS, and MySQL bastion host for Linux. Prior to 0.29.0, the Kubernetes protocol listener uses AcceptAnyClientCert in warpgate-protocol-kubernetes/src/server/client_certs.rs to accept certificates at the TLS layer and defer validation to warpgate-protocol-kubernetes/src/server/auth.rs, where authentication and lookup failures are rendered verbatim in an HTTP 500 response body. The Kubernetes application in warpgate-protocol-kubernetes/src/server/mod.rs lacks the outer request-logging wrapper used by the HTTP protocol, and failures in warpgate-protocol-kubernetes/src/server/handlers.rs can short-circuit before its inner log point. An unauthenticated network client can therefore induce failures and receive ASN.1/DER parser diagnostics or sea_orm database errors without the attempt being recorded in the gateway log. The disclosed information is limited to internal diagnostics, and no user-data, integrity, or availability impact is established. This issue is fixed in version 0.29.0.", "A flaw was found in Warpgate. This vulnerability allows an unauthenticated remote attacker to cause information disclosure by sending malformed connection requests to the Kubernetes protocol listener. Due to improper error handling and missing request logging, the service returns internal database and certificate diagnostics directly in error responses without recording the attempt in the gateway audit log."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-91163", "public_date": "2026-11-04T15:19:15Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-91163\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-91163\nhttps://github.com/warp-tech/warpgate/commit/8426196a27c30fca521656653f9df1faf3df7523\nhttps://github.com/warp-tech/warpgate/pull/2547\nhttps://github.com/warp-tech/warpgate/releases/tag/v0.29.0\nhttps://github.com/warp-tech/warpgate/security/advisories/GHSA-hrfx-fm67-gv64"], "statement": "This vulnerability is evaluated as having Low severity because the exposed information is confined to internal parsing and database diagnostics rather than sensitive user credentials or data records. Furthermore, successful exploitation does not compromise system integrity or cause a denial of service. Warpgate is not packaged or shipped with any Red Hat product, resulting in no direct impact on default Red Hat environments.", "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,0.29.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "warpgate", "source": "cna", "vendor": "warp-tech"}, "product": "warpgate", "vendor": "warp-tech"}], "created": "2026-11-04T16:45:07.565386+00:00", "updated": "2026-11-04T17:15:14.805461+00:00", "vendors": ["warp-tech", "warp-tech$PRODUCT$warpgate"]}