CVE-2026-58491: Warpgate SSH Bastion Host XSS Vulnerability

CVE-2026-58491 Overview

CVE-2026-58491 is a stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in Warpgate, an open source SSH, HTTPS, and MySQL bastion host for Linux. Versions prior to 0.25.5 fail to HTML-escape the attacker-controlled next parameter passed to the /@warpgate/api/sso/providers/:name/start endpoint. The POST /@warpgate/api/sso/return handler then injects that value directly into a response rendered by warpgate-protocol-http/src/api/sso_provider_list.rs. The same unvalidated value is reused as a redirect target in GET /@warpgate/api/sso/return, producing an open redirect. Maintainers fixed the issue in version 0.25.5.

Critical Impact
A victim who clicks a crafted SSO link and completes authentication executes attacker-controlled JavaScript in the authenticated Warpgate origin, exposing session data and enabling actions through user APIs, and administrator APIs when the victim holds admin rights.

Affected Products

Warpgate versions prior to 0.25.5
Warpgate HTTPS protocol handler (warpgate-protocol-http)
Warpgate SSO provider integration endpoints

Discovery Timeline

2026-09-21 - CVE-2026-58491 published to NVD
2026-09-24 - Last updated in NVD database

Technical Details for CVE-2026-58491

Vulnerability Analysis

Warpgate exposes an SSO initiation endpoint that accepts a next query parameter describing where to redirect the browser once authentication completes. The server persists this value against the SSO session state and reuses it on the return path. When the POST /@warpgate/api/sso/return handler renders the response, it interpolates the stored next value into HTML output without escaping metacharacters. An attacker who controls the initial link controls a fragment of the resulting page markup after the victim finishes SSO.

Because the injected script runs inside the authenticated Warpgate origin, it inherits the victim's session. The script can read session identifiers, call user-facing REST APIs, and, when the victim is an administrator, invoke administrative endpoints that manage targets, users, roles, and credentials. The GET /@warpgate/api/sso/return variant uses the same unvalidated value as a Location header target, producing an open redirect suitable for phishing or SSO token laundering.

Root Cause

The root cause is missing output encoding in warpgate-protocol-http/src/api/sso_provider_list.rs. User input flows from a query string, into server-side session storage, and back into an HTML response body without HTML entity escaping. The fix introduces the Rust html-escape crate and applies encoding at the sink.

Attack Vector

Exploitation requires user interaction: the victim must follow an attacker-crafted URL and complete an SSO flow with a configured identity provider. No authentication or privileges are required from the attacker, and the attack traverses the network. The impact scope changes because script executing in the Warpgate origin can act on behalf of the victim across the application boundary.

text

// Patch: Cargo.toml — add html-escape dependency
     "server",
 ], default-features = false }
 hex = { version = "0.4", default-features = false }
+html-escape = { version = "0.2", default-features = false }
 poem-openapi = { version = "5.1", features = [
     "stoplight-elements",
     "uuid",

Source: GitHub Commit eab0548

text

// Patch: Cargo.lock — html-escape crate resolved
+[[package]]
+name = "html-escape"
+version = "0.2.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6d1ad449764d627e22bfd7cd5e8868264fc9236e07c752972b4080cd351cb476"
+dependencies = [
+ "utf8-width",
+]

Source: GitHub Commit eab0548

Detection Methods for CVE-2026-58491

Indicators of Compromise

Requests to /@warpgate/api/sso/providers/:name/start containing next parameter values with HTML tags, javascript: schemes, or encoded angle brackets (%3C, %3E).
Requests to /@warpgate/api/sso/return whose stored next value redirects to an external, non-allowlisted host.
Unexpected outbound requests from Warpgate administrator sessions to attacker-controlled hostnames shortly after SSO completion.

Detection Strategies

Inspect reverse-proxy or web application firewall logs for SSO initiation URLs with suspicious next payloads and correlate with subsequent POST /@warpgate/api/sso/return calls in the same session.
Alert on Warpgate administrative API calls (target creation, role changes, credential exports) that originate immediately after an SSO redirect from an off-domain referrer.
Deploy a Content Security Policy in report-only mode in front of Warpgate to surface inline script violations sourced from SSO response pages.

Monitoring Recommendations

Enable verbose HTTP access logging on the Warpgate front end and forward it to a centralized log platform for retention and query.
Track Warpgate release metadata and installed version through configuration management to detect hosts still running versions below 0.25.5.
Monitor identity provider logs for successful SSO completions followed by anomalous administrative activity in Warpgate within the same time window.

How to Mitigate CVE-2026-58491

Immediate Actions Required

Upgrade all Warpgate deployments to version 0.25.5 or later without delay.
Rotate Warpgate administrator sessions and any long-lived API tokens issued before the upgrade.
Review recent SSO login events and administrative API activity for signs of scripted abuse against admin accounts.

Patch Information

The issue is fixed in Warpgate 0.25.5. The maintainers added the html-escape Rust crate and applied HTML entity encoding to the next value before it is rendered by warpgate-protocol-http/src/api/sso_provider_list.rs. See the GitHub Security Advisory GHSA-3c3w-75j2-7h74 and the GitHub Release v0.25.5 for release artifacts and change notes.

Workarounds

Place Warpgate behind a reverse proxy or WAF that strips or rejects next parameter values containing HTML metacharacters, javascript:, or data: schemes.
Restrict administrator access to trusted networks so that a redirected admin browser cannot reach the Warpgate origin from untrusted contexts.
Instruct users and administrators not to follow SSO links received from untrusted sources until the upgrade is applied.

bash

# Verify the running Warpgate version and upgrade if below 0.25.5
warpgate --version

# Example: pull the patched container image
docker pull ghcr.io/warp-tech/warpgate:0.25.5

# Restart the service after upgrading the binary or image
systemctl restart warpgate