CVE-2026-63329

Name of the Vulnerable Software and Affected Versions Warpgate versions prior to 0.25.6

Description The copy server request function in warpgate-protocol-http/src/proxy.rs forwards a client-supplied x-warpgate-username header before the inject own headers function appends the authenticated username. Since the request builder preserves repeated values, a proxied backend that trusts the first x-warpgate-username value may authorize an authenticated attacker as a different user. Additionally, the forwarding policy accepts the reserved x-warpgate-authentication-type header, and warpgate-common/src/http headers.rs fails to exclude these reserved identity headers.

Recommendations Update to version 0.25.6.