What’s Vulnerable › Vulnerabilities

CVE-2026-63330: Warpgate: Missing Admin Authorization on Live Recording Stream WebSocket Allows Any Authenticated User to Eavesdrop on Terminal Sessions

• Severity: high (CVSS 7.7 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-21 · updated 2026-09-30
• Weakness: CWE-285

Description

Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.25.6, api_get_recording_stream in warpgate-admin/src/api/recordings_detail.rs protects /@warpgate/admin/api/recordings/{uuid}/stream only with session authentication and omits require_admin_permission for AdminPermission::RecordingsView. Any authenticated regular user who identifies an active recording can subscribe to its WebSocket and receive real-time terminal input and output from proxied SSH, MySQL, or PostgreSQL sessions, including credentials, commands, and other sensitive data belonging to users and administrators. This issue is fixed in version 0.25.6.

Affected products

• warp-tech warpgate: before 0.25.6

References

• https://github.com/warp-tech/warpgate/commit/f5cb06ea09065f375870ccee64fe721a2ca79766
• https://github.com/warp-tech/warpgate/releases/tag/v0.25.6
• https://github.com/warp-tech/warpgate/security/advisories/GHSA-2q37-6vxr-26jr
• https://github.com/warp-tech/warpgate/security/advisories/GHSA-2q37-6vxr-26jr

Get alerted when CVE-2026-63330 or the next vulnerability affects your stack