目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1336 元

100%
请我们喝杯咖啡

CVE-2026-63330— Warpgate: Missing Admin Authorization on Live Recording Stream WebSocket Allows Any Authenticated User to Eavesdrop on Terminal Sessions

一分钟漏洞结论

影响对象
warp-tech warpgate
利用判断
尚无明确在野利用证据，仍需结合暴露面评估
建议动作
优先检查厂商安全公告和参考链接中的修复版本；无法立即升级时，限制受影响服务暴露并加强监测。

Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.25.6, api_get_recording_stream in warpgate-admin/src/api/recordings_detail.rs protects /@warpgate/admin/api/recordings/{uuid}/stream only with session authentication and omits r

CVSS 7.7 · High EPSS 0.35% · P29
获取后续新漏洞提醒 登录后订阅

一、 漏洞 CVE-2026-63330 基础信息

漏洞信息

Shenlong is analyzing...

对漏洞内容有疑问？看看神龙的深度分析是否有帮助！
查看神龙十问 ↗

尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。

Vulnerability Title
Warpgate: Missing Admin Authorization on Live Recording Stream WebSocket Allows Any Authenticated User to Eavesdrop on Terminal Sessions
来源: CVE Program / CVE List V5
Vulnerability Description
Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.25.6, api_get_recording_stream in warpgate-admin/src/api/recordings_detail.rs protects /@warpgate/admin/api/recordings/{uuid}/stream only with session authentication and omits require_admin_permission for AdminPermission::RecordingsView. Any authenticated regular user who identifies an active recording can subscribe to its WebSocket and receive real-time terminal input and output from proxied SSH, MySQL, or PostgreSQL sessions, including credentials, commands, and other sensitive data belonging to users and administrators. This issue is fixed in version 0.25.6.
来源: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
来源: CVE Program / CVE List V5
Vulnerability Type
授权机制不恰当
来源: CVE Program / CVE List V5

受影响产品

厂商 产品 影响版本 CPE 订阅
warp-tech warpgate < 0.25.6 -

二、漏洞 CVE-2026-63330 的公开POC

# POC 描述 源链接 神龙链接
AI 生成 POC 高级

未找到公开 POC。

登录以生成 AI POC

三、漏洞 CVE-2026-63330 的情报信息

请登录查看更多情报信息。

CVE-2026-63330 补丁与修复 (1)

CVE-2026-63330 其他参考 (2)

同批安全公告 · warp-tech · 2026-09-21 · 共 7 条

CVE-2026-58491 9.3 CRITICAL Warpgate: Reflected XSS in SSO return endpoint via attacker-controlled next parameter
CVE-2026-91167 6.0 MEDIUM Warpgate: Missing authorization check on `PUT /users/:id/roles/:role_id` allows any admin
CVE-2026-91166 5.7 MEDIUM Warpgate: Web SSH stores a jump host's key against the target's address, so it validates a
CVE-2026-63329 4.9 MEDIUM Warpgate: x-warpgate-username Header Not Stripped from Client Requests Enables Identity Sp
CVE-2026-91164 4.3 MEDIUM Warpgate: API tokens bypass the user's allowed_ip_ranges restriction
CVE-2026-91165 2.4 LOW Warpgate: Markup injection in SSO form_post return page via unencoded redirect/error value

IV. Related Vulnerabilities

Same product: warpgate
Same vendor: warp-tech
Same weakness: CWE-285

V. Comments for CVE-2026-63330

暂无评论

发表评论