Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-91168— Warpgate: Kubernetes authorization correlation can be reused by a recreated same-name account

Quick assessment

Affected
warp-tech warpgate
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Warpgate 是一个面向 Linux 的开源堡垒主机，支持 SSH、HTTPS 和 MySQL 协议。在版本 0.21.0 至 0.29.0 期间，位于 的 Kubernetes 请求关联器（request correlator）使用用户名、目标名称（target_name）和客户端 IP 作为已授权 的索引键，而非使用不可变的用户 UUID；同时， 方法并未移除该条目。若某个账户被删除，随后又创建一个具有相同用户名但权限较低的新账户，则新账户在从同一客户端 IP 向同一目标发起请求时（且在 过期之前），可以成

CVSS 6.8 · Medium
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-91168

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Warpgate: Kubernetes authorization correlation can be reused by a recreated same-name account
Source: CVE Program / CVE List V5
Vulnerability Description
Warpgate is an open source SSH, HTTPS, and MySQL bastion host for Linux. From 0.21.0 until 0.29.0, the Kubernetes request correlator in warpgate-protocol-kubernetes/src/correlator.rs keys an authorized AdmittedTarget by username, target_name, and client IP rather than by the immutable user UUID, while KubernetesSessionHandle::close does not evict the entry. If an account is deleted and a different low-privilege account is created with the same username, the replacement account can successfully authenticate as that recreated username and reuse the predecessor's still-live correlation entry when requesting the same target from the same client IP before kubernetes.session_max_age expires. Current-request authentication still occurs, but the reused entry bypasses a fresh target authorization check and can cause Warpgate to proxy requests with Kubernetes target credentials that the replacement account is not authorized to use, exposing cluster resources or permitting unauthorized mutations. This issue is fixed in version 0.29.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
通过用户控制密钥绕过授权机制
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
warp-tech warpgate >= 0.21.0, < 0.29.0 -

II. Public POCs for CVE-2026-91168

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-91168

请登录查看更多情报信息。

Other References for CVE-2026-91168 (3)

IV. Related Vulnerabilities

Same product: warpgate
Same vendor: warp-tech
Same weakness: CWE-639