CVE-2026-91166

Name of the Vulnerable Software and Affected Versions Warpgate versions 0.25.0 through 0.27.5

Description The browser SSH path in warpgate-web-ssh/src/manager.rs handles RCEvent::HostKeyUnknown without the presenting hop identity. Instead, it passes ssh options.host and ssh options.port for the final target to KnownHosts::trust(). In Prompt and AutoAccept modes, a jump host key may be stored for the target address. Consequently, a machine presenting the jump host key at the target address could be accepted as the target, enabling the interception of user traffic and the acquisition of a newly issued certificate during certificate authentication.

Recommendations Update to version 0.27.6.