CVE-2026-91167: Warpgate Privilege Escalation Vulnerability

CVE-2026-91167 Overview

Warpgate is an open source Secure Shell (SSH), Hypertext Transfer Protocol Secure (HTTPS), and MySQL bastion host for Linux. A missing authorization flaw [CWE-862] in versions prior to 0.28.4 allows a limited administrator to modify existing user role assignments without holding the AdminPermission::AccessRolesAssign capability. The vulnerable endpoint PUT /@warpgate/admin/api/users/:id/roles/:role_id routes through AdminContext and invokes api_update_user_role in warpgate-admin/src/api/users.rs without enforcing the required permission. Any administrator with any permission can update expires_at and clear revoked_at, effectively extending expiring grants or reinstating revoked ones. The issue is fixed in version 0.28.4.

Critical Impact
A low-privileged administrator can prolong or restore role grants they should not be able to manage, undermining role lifecycle controls on a bastion host.

Affected Products

Warpgate versions prior to 0.28.4
warpgate-admin component (warpgate-admin/src/api/users.rs)
Deployments exposing the admin API to multiple administrators with scoped permissions

Discovery Timeline

2026-09-21 - CVE-2026-91167 published to the National Vulnerability Database (NVD)
2026-09-24 - Last updated in NVD database

Technical Details for CVE-2026-91167

Vulnerability Analysis

The flaw resides in the handler api_update_user_role inside warpgate-admin/src/api/users.rs. The endpoint accepts a user identifier, a role identifier, and a JSON body of type UpdateUserRoleRequest. It authenticates the caller as an administrator through AdminContext but never checks the specific AdminPermission::AccessRolesAssign capability required for managing role assignments.

An attacker with any administrative permission can modify two fields on an existing UserRoleAssignment record. Setting expires_at to a later timestamp extends a grant that would otherwise lapse. Clearing revoked_at reinstates a role that an authorized administrator previously revoked. The handler returns not found when the user and role pair does not already exist, so brand new role assignments cannot be created through this path.

Root Cause

The root cause is a missing permission check on a privileged mutation endpoint. AdminContext gates the route to administrators broadly but does not enforce fine-grained role-management authorization. The design intent was for AccessRolesAssign to gate all role assignment mutations, and this endpoint bypassed that model.

Attack Vector

Exploitation requires network access to the Warpgate admin API and valid credentials for any administrative account, regardless of scope. The attacker issues an authenticated PUT request against /@warpgate/admin/api/users/:id/roles/:role_id with a body that adjusts expires_at or clears revoked_at. No user interaction is required.

rust

         role_id: Path<Uuid>,
         body: Json<UpdateUserRoleRequest>,
     ) -> Result<UpdateUserRoleResponse, WarpgateError> {
+        admin.require(AdminPermission::AccessRolesAssign)?;
+
         let db = &admin.services().db;
 
         let Some(role) = Role::Entity::find_by_id(role_id.0).one(db).await? else {

The patch adds an explicit admin.require(AdminPermission::AccessRolesAssign)? call at the top of the handler, blocking any administrator that lacks the specific role-assignment permission. Source: GitHub commit c020900.

Detection Methods for CVE-2026-91167

Indicators of Compromise

HTTP PUT requests to /@warpgate/admin/api/users/:id/roles/:role_id originating from administrator accounts that do not hold AccessRolesAssign.
Audit records showing UserRoleAssignment rows with revoked_at transitioning from a timestamp back to NULL.
Unexpected forward shifts in the expires_at column on active role assignments.

Detection Strategies

Correlate admin API access logs with the internal permission set assigned to each administrator to flag calls to role assignment endpoints by users without AccessRolesAssign.
Enable database change tracking on the UserRoleAssignment table and alert on any update that clears revoked_at or extends expires_at.
Review Warpgate audit logs for role modifications performed outside of expected change windows or by service accounts.

Monitoring Recommendations

Forward Warpgate admin API and audit logs to a central logging platform and retain them for post-incident review.
Alert on any authenticated request to /@warpgate/admin/api/users/*/roles/* and require reconciliation with a ticket or change record.
Periodically export the current set of role assignments and diff against an approved baseline.

How to Mitigate CVE-2026-91167

Immediate Actions Required

Upgrade Warpgate to version 0.28.4 or later on all bastion hosts.
Audit existing UserRoleAssignment records for unexpected changes to expires_at and revoked_at since the vulnerable versions were deployed.
Rotate administrator credentials for any account whose activity cannot be reconciled with authorized changes.

Patch Information

The fix is included in Warpgate 0.28.4, which adds the missing AdminPermission::AccessRolesAssign check to api_update_user_role. Details are available in the GitHub Security Advisory GHSA-fjgc-484v-j6mf and the GitHub Release v0.28.4.

Workarounds

Restrict administrator accounts so that only trusted operators hold any administrative permission, since any admin permission is sufficient to exploit the flaw.
Place the Warpgate admin interface behind network controls that limit access to a small operations network until the upgrade is applied.
Increase audit review cadence for role assignment changes until all instances are running 0.28.4 or later.

bash

# Verify the running Warpgate version and upgrade
warpgate --version
# Upgrade to the patched release
# See https://github.com/warp-tech/warpgate/releases/tag/v0.28.4