CVE-2026-63330: Warpgate Auth Bypass Vulnerability

CVE-2026-63330 Overview

Warpgate is an open source SSH, HTTPS, and MySQL bastion host for Linux. CVE-2026-63330 is a missing authorization flaw [CWE-285] in the api_get_recording_stream function within warpgate-admin/src/api/recordings_detail.rs. The endpoint /@warpgate/admin/api/recordings/{uuid}/stream enforces only session authentication and omits the require_admin_permission check for AdminPermission::RecordingsView. Any authenticated non-administrative user who identifies an active recording UUID can subscribe to its WebSocket stream. This exposes real-time terminal input and output from proxied SSH, MySQL, and PostgreSQL sessions, including credentials and commands entered by other users and administrators. The issue affects Warpgate versions prior to 0.25.6.

Critical Impact
Authenticated low-privilege users can eavesdrop on live administrator SSH, MySQL, and PostgreSQL sessions and harvest plaintext credentials and command output.

Affected Products

Warpgate versions prior to 0.25.6
Warpgate SSH bastion component
Warpgate MySQL and PostgreSQL proxied session recording endpoints

Discovery Timeline

2026-09-21 - CVE-2026-63330 published to NVD
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-63330

Vulnerability Analysis

Warpgate exposes an administrative WebSocket endpoint that streams live terminal recordings for proxied bastion sessions. The route /@warpgate/admin/api/recordings/{uuid}/stream is served by api_get_recording_stream in warpgate-admin/src/api/recordings_detail.rs. The handler validates that the caller has an authenticated session but does not verify the caller holds the AdminPermission::RecordingsView permission. Any regular authenticated user therefore reaches administrative functionality.

Once connected, the WebSocket relays keystrokes and terminal output from active SSH, MySQL, and PostgreSQL sessions proxied through Warpgate. Sensitive material transmitted through the recording stream includes typed passwords, database queries, session tokens, and command output belonging to other users and administrators.

Root Cause

The root cause is a missing authorization check on an administrative API route [CWE-285]. Session authentication was treated as sufficient for the endpoint, and the require_admin_permission guard applied to sibling recording endpoints was omitted here. Authentication was performed without a corresponding permission enforcement layer for AdminPermission::RecordingsView.

Attack Vector

Exploitation requires network reachability to the Warpgate admin API and any valid low-privilege account. The attacker enumerates or discovers an active recording UUID, then opens a WebSocket to /@warpgate/admin/api/recordings/{uuid}/stream. The server begins streaming live terminal I/O. No user interaction from the victim is required beyond the ongoing proxied session.

rust

// Source: https://github.com/warp-tech/warpgate/commit/f5cb06ea09065f375870ccee64fe721a2ca79766
 use tokio::io::{AsyncBufReadExt, BufReader};
 use tracing::error;
 use uuid::Uuid;
-use warpgate_common::AdminPermission;
+use warpgate_common::{AdminPermission, WarpgateError};
 use warpgate_common_http::AuthenticatedRequestContext;
 use warpgate_core::recordings::{AsciiCast, TerminalRecordingItem};
 use warpgate_db_entities::Recording::{self, RecordingKind};

The patch introduces WarpgateError handling alongside AdminPermission, enabling the handler to invoke require_admin_permission(AdminPermission::RecordingsView) and reject non-administrative callers.

Detection Methods for CVE-2026-63330

Indicators of Compromise

WebSocket upgrade requests to /@warpgate/admin/api/recordings/{uuid}/stream from user accounts that lack the RecordingsView admin permission.
Long-lived WebSocket connections to the admin recordings endpoint that correlate in time with active proxied SSH, MySQL, or PostgreSQL sessions.
Access patterns where the same non-admin principal enumerates multiple recording UUIDs in a short interval.

Detection Strategies

Parse Warpgate application and reverse-proxy logs for GET and Upgrade: websocket requests targeting /@warpgate/admin/api/recordings/*/stream, then join with the identity of the calling session.
Alert when the calling account does not carry AdminPermission::RecordingsView in the Warpgate role assignment.
Baseline normal administrative recording review activity and flag deviations in caller identity, source IP, or request volume.

Monitoring Recommendations

Forward Warpgate audit logs and fronting web server access logs to a centralized log platform for retention and correlation.
Monitor for anomalous WebSocket session duration against the admin recordings API and correlate with concurrent proxied database or SSH sessions.
Track successful authentications from low-privilege accounts followed by access attempts to admin-scoped API paths.

How to Mitigate CVE-2026-63330

Immediate Actions Required

Upgrade Warpgate to version 0.25.6, which adds require_admin_permission(AdminPermission::RecordingsView) to the recording stream endpoint.
Rotate credentials that may have been typed into SSH, MySQL, or PostgreSQL sessions proxied by Warpgate while a vulnerable version was deployed.
Audit Warpgate user accounts and revoke any non-essential low-privilege accounts that could have been used to reach the admin API.

Patch Information

The fix is included in Warpgate 0.25.6. See the GitHub Release v0.25.6, the security advisory GHSA-2q37-6vxr-26jr, and the patch commit f5cb06e.

Workarounds

Restrict network access to the Warpgate admin API path /@warpgate/admin/api/* at the reverse proxy or firewall, allowing only administrator source IP ranges until the upgrade is applied.
Temporarily disable session recording features if operational requirements permit, to prevent live streams from being exposed.
Reduce the number of authenticated accounts on Warpgate to trusted operators only during the remediation window.

bash

# Example nginx snippet restricting the admin recordings stream endpoint
location ~ ^/@warpgate/admin/api/recordings/.+/stream$ {
    allow 10.0.0.0/24;   # admin management subnet
    deny  all;
    proxy_pass http://warpgate_backend;
    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection "upgrade";
}