CVE-2026-91164

Name of the Vulnerable Software and Affected Versions Warpgate versions 0.23.0 through 0.27.2

Description HTTP API token authentication fails to enforce the allowed ip ranges of the owning user against the trusted client address during the resolution of ConfigProvider::validate api token into RequestAuthorization::UserToken within the warpgate-protocol-http/src/common.rs file. This allows an attacker with a leaked, phished, or exfiltrated X-Warpgate-Token to authenticate from a prohibited network location. This issue does not affect deployments without configured allowed ip ranges, nor does it impact HTTP target proxying or paths for SSH, MySQL, PostgreSQL, RDP, VNC, and Kubernetes.

Recommendations Update to version 0.27.3.