Back to the CVE list

CVE-2026-91166Proof of concept (PoC) published · CISA

Warpgate: Web SSH stores a jump host's key against the target's address, so it validates as the target

CVSS score

5.7

EPSS probability

%0.2

Risk score

0.0

Published

28 d ago

Overview Public Exploits (0)Newsroom Vulnerability Timeline

Related Security News

Articles and analysis bulletins in which the press and security publications have covered this vulnerability:

No verified news item has been matched to this CVE yet.

Similar Vulnerabilities

9.3

CVE-2026-58491Warpgate: Reflected XSS in SSO return endpoint via attacker-controlled next parameter

Vendorwarp-tech Productwarpgate

Patch status unknownEPSS %028 d ago

7.7

CVE-2026-63330Warpgate: Missing Admin Authorization on Live Recording Stream WebSocket Allows Any Authenticated User to Eavesdrop on Terminal Sessions

Vendorwarp-tech Productwarpgate

Patch status unknownEPSS %028 d ago

6.0

CVE-2026-91167Warpgate: Missing authorization check on `PUT /users/:id/roles/:role_id` allows any admin to bypass the `AccessRolesAssign` permission boundary

Vendorwarp-tech Productwarpgate

Patch status unknownEPSS %028 d ago

4.3

CVE-2026-91164Warpgate: API tokens bypass the user's allowed_ip_ranges restriction

Vendorwarp-tech Productwarpgate

Patch status unknownEPSS %028 d ago

4.9

CVE-2026-63329Warpgate: x-warpgate-username Header Not Stripped from Client Requests Enables Identity Spoofing to WebSocket Backend Targets

Vendorwarp-tech Productwarpgate

Patch status unknownEPSS %028 d ago

2.4

CVE-2026-91165Warpgate: Markup injection in SSO form_post return page via unencoded redirect/error values

Vendorwarp-tech Productwarpgate

Patch status unknownEPSS %028 d ago

Get this vulnerability through the API

Affected products, version ranges, exploitation status and patch information in a single request, with a free key.

Get a free key Documentation

curl -H "x-api-key: $DAYBREACH_API_KEY" \
  "https://api.daybreach.dev/api/v1/intel/cves/CVE-2026-91166"