CVE-2026-91168

Name of the Vulnerable Software and Affected Versions Warpgate versions 0.21.0 through 0.28.0

Description The Kubernetes request correlator in warpgate-protocol-kubernetes/src/correlator.rs uses username, target name, and client IP to key an authorized AdmittedTarget instead of using the immutable user UUID. Additionally, the KubernetesSessionHandle::close() function fails to evict the entry. This allows a new low-privilege account created with a previously deleted username to reuse a still-active correlation entry if they request the same target from the same client IP before kubernetes.session max age expires. While authentication still occurs, this reuse bypasses the target authorization check, potentially allowing the account to proxy requests using Kubernetes target credentials they are not authorized to use, which could lead to unauthorized mutations or exposure of cluster resources.

Recommendations Update to version 0.29.0.