{"id":"CVE-2026-91166","summary":"Warpgate: Web SSH stores a jump host's key against the target's address, so it validates as the target","details":"Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. From 0.25.0 until 0.27.6, the browser SSH path in warpgate-web-ssh/src/manager.rs handles RCEvent::HostKeyUnknown without the presenting hop identity and instead passes ssh_options.host and ssh_options.port for the final target to KnownHosts::trust. In Prompt and AutoAccept modes, a jump host key can therefore be stored for the target address. A machine later presenting the jump host key at the target address can be accepted as the target, allowing interception of user traffic and a newly issued certificate when certificate authentication is used. The native SSH path is unaffected because it tracks each hop separately. This issue is fixed in version 0.27.6.","aliases":["GHSA-w9jj-vpw3-5r8f"],"modified":"2026-09-23T03:47:29.418735507Z","published":"2026-09-21T18:53:56.224Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-297","CWE-923"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91166.json"},"references":[{"type":"WEB","url":"https://github.com/warp-tech/warpgate/releases/tag/v0.27.6"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91166.json"},{"type":"ADVISORY","url":"https://github.com/warp-tech/warpgate/security/advisories/GHSA-w9jj-vpw3-5r8f"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91166"},{"type":"FIX","url":"https://github.com/warp-tech/warpgate/commit/fb66ff74f979c22054f4d348cc0d9065cc67e5d3"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/warp-tech/warpgate","events":[{"introduced":"59c7093af80b9dc561c936a9ead20879ea9a409a"},{"fixed":"fb66ff74f979c22054f4d348cc0d9065cc67e5d3"},{"fixed":"3f166ef2fb27d3e6785df315fdc39914f0568404"}],"database_specific":{"source":["AFFECTED_FIELD","REFERENCES"],"extracted_events":[{"introduced":"0.25.0"},{"fixed":"0.27.6"}]}}],"versions":["v0.27.5","v0.27.4","v0.27.3","v0.27.2","v0.27.1","chart-v0.0.7","v0.27.0","v0.27.0-beta.5","v0.27.0-beta.4","v0.27.0-beta.3","v0.27.0-beta.2","chart-v0.0.6","v0.27.0-beta.1","v0.26.0","v0.26.0-beta.1","v0.25.5","v0.25.4","v0.25.3","v0.25.2","v0.25.1","v0.25.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-91166.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N"}]}