CVE-2026-63329: Warpgate Bastion Auth Bypass Vulnerability

CVE-2026-63329 Overview

CVE-2026-63329 is an identity header forwarding flaw in Warpgate, an open source Secure Shell (SSH), HTTPS, and MySQL bastion host for Linux. Prior to version 0.25.6, the HTTP proxy forwards a client-supplied x-warpgate-username header to upstream targets before Warpgate injects the authenticated username. Backends that trust the first x-warpgate-username value can authorize an authenticated attacker as a different user. The reserved x-warpgate-authentication-type header is also forwarded, expanding the identity spoofing surface. The issue is fixed in version 0.25.6.

Critical Impact

An authenticated Warpgate user can impersonate another user against proxied HTTP backends that trust reserved x-warpgate-* identity headers, resulting in horizontal or vertical privilege escalation.

Affected Products

• Warpgate (warp-tech/warpgate) versions prior to 0.25.6
• Component: warpgate-protocol-http (HTTP proxy)
• Component: warpgate-common HTTP header handling

Discovery Timeline

• 2026-09-21 - CVE-2026-63329 published to the National Vulnerability Database (NVD)
• 2026-09-24 - Last updated in NVD database

Technical Details for CVE-2026-63329

Vulnerability Analysis

Warpgate acts as an authenticating reverse proxy that annotates upstream requests with identity headers such as x-warpgate-username and x-warpgate-authentication-type. In vulnerable releases, copy_server_request in warpgate-protocol-http/src/proxy.rs copies inbound client headers into the outbound request. Subsequently, inject_own_headers appends the authenticated username, producing two x-warpgate-username values when a client supplies one.

Because the HTTP request builder preserves repeated header values, downstream applications that read the first occurrence resolve the attacker-controlled identity rather than the value Warpgate appended. The exposure is amplified because warpgate-common/src/http_headers.rs did not include either reserved identity header in the do-not-forward set. This maps to Improper Encoding or Escaping of Output [CWE-116].

Root Cause

The DONT_FORWARD_HEADERS allowlist omitted the reserved x-warpgate-username and x-warpgate-authentication-type headers. Combined with append-only injection, this allowed client-supplied identity values to persist alongside the server-authenticated values in proxied requests.

Attack Vector

An authenticated Warpgate user sends an HTTP request through the bastion targeting a proxied backend and adds a forged x-warpgate-username header naming another user. Warpgate forwards both the injected header and its own appended value. Backends that read the first x-warpgate-username treat the request as originating from the impersonated identity.

// Patch: warpgate-protocol-http/src/proxy.rs
 use url::Url;
 use warpgate_common::helpers::websocket::pump_websocket;
 use warpgate_common::http_headers::{
-    DONT_FORWARD_HEADERS, X_FORWARDED_FOR, X_FORWARDED_HOST, X_FORWARDED_PROTO,
+    X_FORWARDED_FOR, X_FORWARDED_HOST, X_FORWARDED_PROTO, may_forward_header,
 };
 use warpgate_common::{TargetHTTPOptions, WarpgateError, try_block};
 use warpgate_common_http::logging::{get_client_ip, log_request_result};

The patch replaces the flat DONT_FORWARD_HEADERS set with a may_forward_header helper that centralizes the exclusion policy, including the reserved identity headers. Source: GitHub Commit c3748d75.

Detection Methods for CVE-2026-63329

Indicators of Compromise

• Duplicate x-warpgate-username headers observed in upstream request logs on proxied backends.
• Requests containing a client-supplied x-warpgate-authentication-type header prior to upgrading to 0.25.6.
• Backend audit records showing user actions inconsistent with the Warpgate session's authenticated principal.

Detection Strategies

• Instrument upstream HTTP servers behind Warpgate to log the count and full values of x-warpgate-username per request, alerting on any count greater than one.
• Correlate Warpgate session identity with backend application user identity and flag mismatches.
• Review reverse proxy access logs for unusual x-warpgate-* headers arriving from client-side sources.

Monitoring Recommendations

• Forward Warpgate and backend access logs to a centralized analytics platform and build queries for repeated reserved headers.
• Track Warpgate version inventory across hosts and alert when any instance runs a release earlier than 0.25.6.
• Baseline per-user backend activity so that lateral impersonation attempts stand out against normal usage.

How to Mitigate CVE-2026-63329

Immediate Actions Required

• Upgrade all Warpgate instances to version 0.25.6 or later without delay.
• Audit backend applications that trust x-warpgate-username or x-warpgate-authentication-type for evidence of prior impersonation.
• Rotate credentials and re-evaluate authorization for high-privilege accounts recently accessed through Warpgate.

Patch Information

The fix is available in GitHub Release v0.25.6 and merged in GitHub Commit c3748d75. Full details are documented in GitHub Security Advisory GHSA-862h-v6cc-9757.

Workarounds

• Strip inbound x-warpgate-username and x-warpgate-authentication-type headers at an upstream WAF or ingress before they reach Warpgate.
• Configure backend applications to read only the last occurrence of x-warpgate-username, or reject requests containing duplicates.
• Restrict Warpgate HTTP proxy targets to backends that perform independent authentication rather than trusting proxy-supplied identity headers.

# Example nginx pre-Warpgate filter to strip client-supplied reserved headers
proxy_set_header x-warpgate-username "";
proxy_set_header x-warpgate-authentication-type "";