---
id: "CVE-2026-91163"
kind: "vulnerability"
aliases: ["CVE-2026-91163"]
title: "Warpgate: Kubernetes listener leaks internal errors and skips request logging"
severity: "low"
cvss: 3.7
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["kubernetes", "package", "self-hosted", "warpgate"]
not_affected_if: ["kubernetes-listener-disabled", "version-0.29.0-or-later"]
published_at: "2026-11-04T16:17:54+00:00"
first_seen_at: "2026-11-04T16:28:15+00:00"
updated_at: "2026-11-04T16:29:00+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91163", "first_seen_at": "2026-11-04T16:28:15+00:00"}]
---

# Warpgate: Kubernetes listener leaks internal errors and skips request logging

Warpgate's Kubernetes protocol listener accepts any client certificate at the TLS layer and returns authentication and database error text in HTTP 500 responses. An unauthenticated network client can read internal diagnostics, and the attempts are not recorded in the gateway log.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Warpgate version: `warpgate --version` (or the version in your deployment image), and see whether it is below `0.29.0`.
- Check whether the Kubernetes protocol listener is enabled in the Warpgate configuration.

## Fix

- Warpgate: upgrade to `0.29.0`

## Timeline

- 2026-11-04T16:28:15+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-91163

## Documents

- [advisory] Vendor advisory: github.com https://github.com/warp-tech/warpgate/security/advisories/GHSA-hrfx-fm67-gv64
- [fix] Patch: github.com https://github.com/warp-tech/warpgate/commit/8426196a27c30fca521656653f9df1faf3df7523
- [fix] Release notes: github.com https://github.com/warp-tech/warpgate/releases/tag/v0.29.0

## From the sources

Warpgate is an open source SSH, HTTPS, and MySQL bastion host for Linux. Prior to 0.29.0, the Kubernetes protocol listener uses AcceptAnyClientCert in warpgate-protocol-kubernetes/src/server/client_certs.rs to accept certificates at the TLS layer and defer validation to warpgate-protocol-kubernetes/src/server/auth.rs, where authentication and lookup failures are rendered verbatim in an HTTP 500 response body. The Kubernetes application in warpgate-protocol-kubernetes/src/server/mod.rs lacks the outer request-logging wrapper used by the HTTP protocol, and failures in warpgate-protocol-kubernetes/src/server/handlers.rs can short-circuit before its inner log point. An unauthenticated network client can therefore induce failures and receive ASN.1/DER parser diagnostics or sea_orm database errors without the attempt being recorded in the gateway log. The disclosed information is limited to internal diagnostics, and no user-data, integrity, or availability impact is established. This issue is fixed in version 0.29.0.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_