CVE-2026-91163— Warpgate: Kubernetes listener discloses internal error text to an unauthenticated caller

Quick assessment

Affected

warp-tech warpgate

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Warpgate 是一个面向 Linux 的开源堡垒主机，支持 SSH、HTTPS 和 MySQL 协议。在 0.29.0 版本之前，其 Kubernetes 协议监听器在中使用了配置，在 TLS 层接受客户端证书，并将证书验证推迟到模块中进行。当认证或查找失败时，相关错误信息会被原样写入 HTTP 500 响应的正文中。此外，位于的 Kubernetes 应用模块缺少 HTTP 协议所使用的最外层请求日志包装器；而中的处理失败可能在触及内部日志记录点之前就触发短路（short-circuit）退出。因

CVSS 3.7 · Low Updated Nov 04, 2026

Possible ATT&CK Techniques 2 AI

T1069 · Permission Groups Discovery T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Warpgate: Kubernetes listener discloses internal error text to an unauthenticated caller

Source: CVE Program / CVE List V5

Vulnerability Description

Warpgate is an open source SSH, HTTPS, and MySQL bastion host for Linux. Prior to 0.29.0, the Kubernetes protocol listener uses AcceptAnyClientCert in warpgate-protocol-kubernetes/src/server/client_certs.rs to accept certificates at the TLS layer and defer validation to warpgate-protocol-kubernetes/src/server/auth.rs, where authentication and lookup failures are rendered verbatim in an HTTP 500 response body. The Kubernetes application in warpgate-protocol-kubernetes/src/server/mod.rs lacks the outer request-logging wrapper used by the HTTP protocol, and failures in warpgate-protocol-kubernetes/src/server/handlers.rs can short-circuit before its inner log point. An unauthenticated network client can therefore induce failures and receive ASN.1/DER parser diagnostics or sea_orm database errors without the attempt being recorded in the gateway log. The disclosed information is limited to internal diagnostics, and no user-data, integrity, or availability impact is established. This issue is fixed in version 0.29.0.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

通过错误消息导致的信息暴露

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
warp-tech	warpgate	< 0.29.0	-

II. Public POCs for CVE-2026-91163

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-91163

请登录查看更多情报信息。

Other References for CVE-2026-91163 (4)

https://github.com/warp-tech/warpgate/pull/2547 x_refsource_MISC
https://github.com/warp-tech/warpgate/releases/tag/v0.29.0 x_refsource_MISC
https://github.com/warp-tech/warpgate/security/advisories/GHSA-hrfx-fm67-gv64 x_refsource_CONFIRM
https://github.com/warp-tech/warpgate/commit/8426196a27c30fca521656653f9df1faf3df7523 x_refsource_MISC

https://www.cve.org/CVERecord?id=CVE-2026-91163

IV. Related Vulnerabilities

Same product: warpgate

Same vendor: warp-tech

Same weakness: CWE-209