CVE-2026-48721: Warp Auth Bypass Vulnerability

CVE-2026-48721 Overview

Warp, an agentic development environment, contains a command execution permission-check bypass in the default unsandboxed CLI agent profile. The vulnerability affects versions from 0.2025.10.08.08.12.stable_00 until 0.2026.05.06.15.42.stable_01. The CLI profile is non-interactive and relies on a command denylist as a safety boundary for commands requiring confirmation. Command strings were checked before canonicalizing leading environment-variable assignments, allowing attackers who influence the agent's command output to bypass the denylist. This issue is classified under [CWE-180] (Incorrect Behavior Order: Validate Before Canonicalize).

Critical Impact
An attacker who can influence the agent's command output may cause denylisted commands to execute without confirmation, leading to arbitrary command execution on the local system.

Affected Products

Warp agentic development environment versions 0.2025.10.08.08.12.stable_00 through 0.2026.05.06.15.42.stable_01 (exclusive)
Default unsandboxed CLI agent profile
Non-interactive CLI mode relying on command denylist enforcement

Discovery Timeline

2026-06-24 - CVE-2026-48721 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-48721

Vulnerability Analysis

The vulnerability resides in Warp's CLI agent permission-check logic. Warp uses a command denylist to identify commands that require explicit user confirmation before execution. The denylist check operated on raw command strings without first canonicalizing them. Leading environment-variable assignments such as PAGER=0 git log were not stripped before string matching against the denylist. An attacker who controls or influences the agent's command output can prepend benign-looking environment-variable assignments to denylisted commands, evading the safety check entirely.

Root Cause

The root cause is an ordering flaw between validation and canonicalization. The permission-check logic compared command strings against the denylist before normalizing the command structure. A command like FOO=bar dangerous_command --args would not match dangerous_command in the denylist because the literal string prefix differed. This is the canonical [CWE-180] pattern — validating input before transforming it into its canonical form.

Attack Vector

Exploitation requires that an attacker can influence the output the CLI agent processes. This typically occurs through prompt injection or by controlling content the agent reads (files, web pages, command output). The agent then proposes a command containing a leading environment-variable assignment that masks a denylisted operation. User interaction is required to start the agent session, but the denylist bypass occurs without further confirmation.

rust

// Patch: command_without_leading_env_vars added to strip env-var prefixes
// before the denylist comparison runs.
pub fn command_without_leading_env_vars<S: AsRef<str>>(
    source: S,
    escape_char: EscapeChar,
) -> Option<String> {
    let source = source.as_ref();
    let parser = Parser::new(Lexer::new(source, escape_char, false));
    let mut command = parser.parse().commands.into_iter().next()?;
    command.item.remove_leading_env_vars();

    command.item.source(source)
}
// Source: https://github.com/warpdotdev/warp/commit/0c1e243292c642d9a7748f80813b6fdfc0b31a9e

The fix introduces command_without_leading_env_vars in crates/warp_completer/src/parsers/simple/mod.rs and invokes it from app/src/ai/blocklist/permissions.rs so that environment-variable prefixes are stripped before the denylist check runs.

Detection Methods for CVE-2026-48721

Indicators of Compromise

Unexpected execution of commands prefixed with environment-variable assignments such as VAR=value <command> originating from the Warp CLI agent
Warp process executing denylisted binaries (for example file deletion, package management, or credential-access commands) without a confirmation prompt in shell history
Agent session logs showing commands proposed from untrusted input sources (files, web content, command output) containing leading env-var assignments

Detection Strategies

Audit Warp CLI agent logs for commands containing leading KEY=VALUE assignments followed by sensitive binaries
Inspect shell history files for command patterns inconsistent with normal interactive use
Compare the installed Warp version against 0.2026.05.06.15.42.stable_01 to identify vulnerable hosts

Monitoring Recommendations

Enable endpoint process monitoring to capture full command lines, including environment-variable prefixes, for Warp child processes
Alert on Warp spawning shells or binaries commonly found on denylists (for example rm, curl | sh, sudo)
Track file integrity on the Warp binary and its configuration to detect unauthorized profile changes that disable sandboxing

How to Mitigate CVE-2026-48721

Immediate Actions Required

Upgrade Warp to version 0.2026.05.06.15.42.stable_01 or later on all developer workstations
Inventory all systems running Warp CLI agent profiles and prioritize unsandboxed deployments for immediate patching
Review recent agent session transcripts for evidence of denylist bypass attempts

Patch Information

The vulnerability is fixed in Warp 0.2026.05.06.15.42.stable_01. The fix strips leading environment-variable assignments before evaluating commands against the denylist. See the GitHub Security Advisory GHSA-3839-h8jj-ph82 and the GitHub Commit Reference for technical details.

Workarounds

Disable the default unsandboxed CLI agent profile and require interactive confirmation for all command execution
Avoid running the Warp CLI agent against untrusted input sources that could inject command suggestions
Restrict the privileges of accounts running Warp to limit blast radius if the denylist is bypassed

bash

# Verify the installed Warp version is patched
warp --version

# Expected: 0.2026.05.06.15.42.stable_01 or later