CVE-2026-91163 · Package
NO FIX YET · SEE WHAT TO DO
Warpgate's Kubernetes protocol listener accepts any client certificate at the TLS layer and returns authentication and database error text in HTTP 500 responses. An unauthenticated network client can read internal diagnostics, and the attempts are not recorded in the gateway log.
first public Sep 18, 2026 · 1 source
Is this in your stack? Find out in 2 minutes.
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Teams running Warpgate as a bastion with the Kubernetes protocol listener exposed to the network. The flaw is in the TLS and error-handling path of that listener, so deployments that do not enable it are not exposed. The sources report only internal diagnostics disclosure, with no stated data-integrity or availability impact.
Not affected if kubernetes-listener-disabled, version-0.29.0-or-later
Who cares kubernetes, self-hosted, warpgate
warpgate --version (or the version in your deployment image), and see whether it is below 0.29.0.0.29.0Warpgate is an open source SSH, HTTPS, and MySQL bastion host for Linux. Prior to 0.29.0, the Kubernetes protocol listener uses AcceptAnyClientCert in warpgate-protocol-kubernetes/src/server/client_certs.rs to accept certificates at the TLS layer and defer validation to warpgate-protocol-kubernetes/src/server/auth.rs, where authentication and lookup failures are rendered verbatim in an HTTP 500 response body. The Kubernetes application in warpgate-protocol-kubernetes/src/server/mod.rs lacks the outer request-logging wrapper used by the HTTP protocol, and failures in warpgate-protocol-kubernetes/src/server/handlers.rs can short-circuit before its inner log point. An unauthenticated network client can therefore induce failures and receive ASN.1/DER parser diagnostics or sea_orm database errors without the attempt being recorded in the gateway log. The disclosed information is limited to internal diagnostics, and no user-data, integrity, or availability impact is established. This issue is fixed in version 0.29.0.
This page as .md · .json · in your agent: get_signal("CVE-2026-91163") · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.