Description

Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. From 0.23.0 until 0.27.3, HTTP API token authentication resolves ConfigProvider::validate_api_token into RequestAuthorization::UserToken without enforcing the owning user's allowed_ip_ranges against the trusted client address in warpgate-protocol-http/src/common.rs. An attacker holding a leaked, phished, or exfiltrated X-Warpgate-Token can therefore use it from a prohibited network location. Deployments without allowed_ip_ranges are unaffected, and HTTP target proxying plus SSH, MySQL, PostgreSQL, RDP, VNC, and Kubernetes paths do not accept this vulnerable HTTP token flow. This issue is fixed in version 0.27.3.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-09-21T19:17:14.993Z",
  "pubdate": "2026-09-21T19:17:14.993Z",
  "executiveSummary": "Warpgate versions 0.23.0 through 0.27.3 are susceptible to an improper authorization vulnerability regarding HTTP API token validation. The flaw resides in the handling of allowed_ip_ranges within the authentication process for the HTTP API.\nWhen an attacker obtains a legitimate X-Warpgate-Token, they can bypass the intended network-level access restrictions configured for that specific user. The system fails to validate the client's source IP address against the user's defined whitelist during the token authentication phase.\nThis vulnerability specifically affects deployments using HTTP API token authentication and does not impact SSH, MySQL, PostgreSQL, RDP, VNC, or Kubernetes proxy flows. The risk is significant for deployments relying on network-based restrictions to secure API access, as it enables unauthorized access from any network location using a compromised token.\nExploitation requires the attacker to possess a valid, exfiltrated, or leaked X-Warpgate-Token. Deployments that have not explicitly configured allowed_ip_ranges for their users are not vulnerable.",
  "technicalDetails": "The vulnerability originates in warpgate-protocol-http/src/common.rs, specifically within the ConfigProvider::validate_api_token function. During the authentication handshake, the system resolves the provided API token into a RequestAuthorization::UserToken structure.\nThe root cause is a failure in the logic flow to cross-reference the incoming request's source IP address against the 'allowed_ip_ranges' attribute associated with the user account owning the token. By omitting this verification step, the HTTP API layer treats the token as universally valid regardless of the originating network context, effectively nullifying the security control intended to restrict API access to trusted or internal subnets.\nAn attack scenario begins with the acquisition of a valid X-Warpgate-Token through means such as log exposure, phishing, or credential exfiltration. The attacker then initiates an HTTP request to the Warpgate API, injecting the stolen token into the header. Because the authentication logic incorrectly bypasses IP validation, the Warpgate server accepts the request even if the attacker's source IP is outside the intended 'allowed_ip_ranges' defined in the server configuration.\nThe scope of this issue is isolated to the HTTP API token authentication mechanism. Other protocols supported by Warpgate, such as SSH, MySQL, PostgreSQL, RDP, VNC, and Kubernetes, utilize different authentication paths that are not affected by this specific logic error. Consequently, the impact is limited to API operations permitted by the leaked token's associated permissions.\nThis vulnerability highlights a failure in enforcing security policies at the application layer when processing authenticated sessions. By failing to integrate the IP range check into the RequestAuthorization flow, the application creates a disparity between the security policy and the actual access control enforcement. The lack of validation ensures that the perimeter restriction is strictly ignored, provided the token is cryptographically or logically valid in the eyes of the token validator."
}