CVE-2026-91166

5.7 MEDIUMpublic exploit available

Published 2026-09-21 · Updated 2026-09-21

AI risk analysis

Summary: This flaw allows a jump host key to be stored for a target address, enabling interception of user traffic and certificate authentication when exploited.
Exploitability: Exploitation requires control over a jump host and knowledge of the target address; relatively complex but feasible with proper conditions.
Blast radius: If exploited, it could lead to significant data interception and unauthorized access in real-world scenarios involving SSH and certificate authentication.
Prioritized remediation: Update Warpgate to version 0.27.6 or later to mitigate this vulnerability.

sshinterceptioncertificatevulnerability

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. From 0.25.0 until 0.27.6, the browser SSH path in warpgate-web-ssh/src/manager.rs handles RCEvent::HostKeyUnknown without the presenting hop identity and instead passes ssh_options.host and ssh_options.port for the final target to KnownHosts::trust. In Prompt and AutoAccept modes, a jump host key can therefore be stored for the target address. A machine later presenting the jump host key at the target address can be accepted as the target, allowing interception of user traffic and a newly issued certificate when certificate authentication is used. The native SSH path is unaffected because it tracks each hop separately. This issue is fixed in version 0.27.6.

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N

Weaknesses

CWE-297, CWE-923

Public exploit & PoC references

All references

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

Related by shared AI tags and CWE weakness class. Browse the full archive.