Database/Control plane, storage & DevOps

Warpgate: Kubernetes listener returns internal errors to unauthenticated clients and skips logging them

CVSS 3.7CVE-2026-91163Control plane, storage & DevOpscurated

Impact

Warpgate's Kubernetes protocol listener accepts any client certificate at the TLS layer and checks it later. When that check fails, the HTTP 500 response contains the raw ASN.1/DER parser output or sea_orm database errors. These failed attempts can also bypass the gateway's request log. An unauthenticated client can therefore probe the bastion that fronts cluster access, learn internal diagnostics, and leave no trace in Warpgate's own logs. The advisory says the leak is limited to internal diagnostics, with no effect on user data, integrity or availability.

Who can reach it

Anyone who can reach Warpgate's Kubernetes listener over the network. No authentication is needed.

What to do

Upgrade Warpgate to 0.29.0 or later and restart the Warpgate service. Until then, limit network access to the Kubernetes listener, and do not count on Warpgate's logs to show failed attempts against it.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-91163 https://github.com/warp-tech/warpgate/security/advisories/GHSA-hrfx-fm67-gv64 https://github.com/warp-tech/warpgate/commit/8426196a27c30fca521656653f9df1faf3df7523 https://github.com/warp-tech/warpgate/releases/tag/v0.29.0

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.