Description

Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.25.6, api_get_recording_stream in warpgate-admin/src/api/recordings_detail.rs protects /@warpgate/admin/api/recordings/{uuid}/stream only with session authentication and omits require_admin_permission for AdminPermission::RecordingsView. Any authenticated regular user who identifies an active recording can subscribe to its WebSocket and receive real-time terminal input and output from proxied SSH, MySQL, or PostgreSQL sessions, including credentials, commands, and other sensitive data belonging to users and administrators. This issue is fixed in version 0.25.6.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.7",
  "pubDate": "2026-09-21T19:17:08.440Z",
  "pubdate": "2026-09-21T19:17:08.440Z",
  "executiveSummary": "Warpgate versions prior to 0.25.6 contain an improper access control vulnerability within the session recording streaming API.\nThe vulnerability allows any authenticated regular user to bypass administrative permission requirements when accessing sensitive session data.\nBy targeting the endpoint /@warpgate/admin/api/recordings/{uuid}/stream, an attacker can subscribe to WebSockets associated with active proxy sessions.\nThis unauthorized access enables the real-time interception of SSH, MySQL, and PostgreSQL traffic, including command execution, interactive terminal output, and plain-text credentials.\nThe risk is critical as it facilitates unauthorized surveillance of administrative and user sessions, potentially leading to full system compromise or lateral movement.\nExploitation requires the attacker to possess a valid standard user account and the ability to identify the unique UUID of an active session.",
  "technicalDetails": "The root cause of this vulnerability lies in the insufficient authorization logic implemented in the api_get_recording_stream function located within warpgate-admin/src/api/recordings_detail.rs.\nSpecifically, the API endpoint /@warpgate/admin/api/recordings/{uuid}/stream was configured to perform session authentication to verify that a request originated from a logged-in user, but it failed to enforce the mandatory AdminPermission::RecordingsView check.\nIn the Warpgate permission model, the AdminPermission::RecordingsView permission is designated to restrict access to sensitive session recordings and real-time stream data to authorized administrators only.\nBecause the function fails to validate this permission, any authenticated user—regardless of their privilege level—can successfully initiate a WebSocket connection to a streaming session.\nThe attack flow begins with an authenticated attacker enumerating or guessing the UUID of a target session that is currently being proxied through the Warpgate bastion.\nUpon establishing a connection to the WebSocket endpoint, the Warpgate service fails to block the stream, effectively broadcasting the real-time input and output of the proxied session to the attacker's client.\nThe exposed data stream provides full visibility into terminal interactions. For SSH sessions, this includes the keystrokes entered by the user (which may contain passwords or private keys) and the server's responses. For database protocols like MySQL or PostgreSQL, the stream exposes query execution, result sets, and administrative commands.\nThis vulnerability is strictly an authorization bypass. The authentication check is present, preventing unauthenticated external entities from accessing the stream; however, the lack of granular privilege verification allows horizontal and vertical privilege escalation within the platform.\nThe vulnerability affects all Warpgate versions prior to 0.25.6. The issue is resolved in version 0.25.6 by explicitly adding the require_admin_permission middleware or function call to the streaming API handler to ensure that only users with appropriate administrative entitlements can subscribe to sensitive session streams."
}