CVE-2026-58491

Executive Summary

Warpgate is an open source SSH, HTTPS, and MySQL bastion host for Linux. Prior to version 0.25.5, a reflected cross-site scripting (XSS) vulnerability exists in the SSO provider handling code. An attacker can craft a link containing a malicious next parameter that, when a victim completes SSO authentication, executes arbitrary JavaScript in the authenticated Warpgate origin. This allows session data access and user API actions, and administrator API actions if the victim is an administrator. Additionally, the same unvalidated parameter enables an open redirect via the GET endpoint. The issue is rated CVSS 9.3 (Critical) and is currently unpatched according to tracked sources, though the vendor states version 0.25.5 contains a fix.

Technical Analysis

The vulnerability resides in the Warpgate HTTP API handling of SSO provider flows. The endpoint /@warpgate/api/sso/providers/:name/start accepts a next parameter controlled by the requestor and stores it without validation. Later, the POST handler for /@warpgate/api/sso/return inserts this stored value into the generated HTML response. The response is produced by the component located at warpgate-protocol-http/src/api/sso_provider_list.rs. Because the value is inserted without HTML escaping, an attacker can inject markup and JavaScript. This is a classic reflected/stored XSS (CWE-79) where the injection occurs in the context of the authenticated Warpgate origin after the victim completes SSO. The GET variant of /@warpgate/api/sso/return uses the same unvalidated next value as a redirect destination, resulting in an open redirect. The attack surface is the web interface exposed by Warpgate, typically on HTTPS. The next parameter is the sole injection vector identified. No further code-level details (e.g., specific escaping functions or template engine) are provided in the description, so the exact rendering mechanism cannot be confirmed beyond the file path mentioned.

Exploitation Scenarios

1. Reconnaissance/Target Identification: An attacker identifies a Warpgate instance exposed to the internet, likely via Shodan or direct scanning for the Warpgate web interface. The attacker notes the SSO provider name or guesses common ones.

2. Triggering the Flaw: The attacker crafts a URL to /@warpgate/api/sso/providers/:name/start?next=<malicious_payload>. The next parameter contains a JavaScript payload, for example a script that exfiltrates session cookies or performs actions on behalf of the user. The attacker sends this link to a victim who is a Warpgate user or administrator.

3. Payload/Execution Method: When the victim clicks the link and completes the SSO login flow (if not already authenticated), the Warpgate server processes the POST to /@warpgate/api/sso/return, inserting the unescaped next value into the HTML response. The victim's browser executes the JavaScript in the context of the Warpgate origin. Alternatively, the GET variant of /@warpgate/api/sso/return redirects the victim to an attacker-controlled site (open redirect), which can be used for phishing or further exploitation.

4. Post-Exploitation Impact: The executed JavaScript can access session data and perform actions through user APIs. If the victim is an administrator, the attacker can leverage administrator APIs to compromise the entire Warpgate instance, potentially leading to lateral movement into managed SSH, HTTPS, or MySQL sessions. No public PoC is available; the attack chain is inferred from the vulnerability class (XSS and open redirect) and the specific endpoints and parameter named in the description.

Impact Assessment

The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N, resulting in a base score of 9.3 (Critical). The scope is changed (S:C), meaning the vulnerable component impacts resources beyond its security scope. Confidentiality and Integrity impacts are High (C:H/I:H), while Availability is None (A:N). The attack requires user interaction (UI:R) because the victim must follow a crafted link and complete SSO. No privileges are required (PR:N) and the attack is network-accessible (AV:N). Business impact includes unauthorized access to sensitive session data, potential full administrative control of the bastion host, and the ability to pivot into managed systems. The blast radius depends on the privileges of the victim; an administrator victim leads to complete compromise of the Warpgate environment. The open redirect can facilitate phishing campaigns and credential theft. No affected version list or OSV packages were provided, but the description states versions prior to 0.25.5 are vulnerable.

Detection Guidance

Sigma Rule

title: Warpgate SSO XSS Attempt via next Parameter
id: 8f4a2b1c-3d5e-4f7a-9b2c-1d3e4f5a6b7c
status: experimental
description: Detects attempts to exploit CVE-2026-58491 by injecting script tags or JavaScript into the next parameter of Warpgate SSO endpoints.
author: Threat Intelligence
date: 2026-01-01
logsource:
  category: webserver
  product: warpgate
detection:
  selection_start:
    cs-uri-stem|contains: '/@warpgate/api/sso/providers/'
    cs-uri-stem|endswith: '/start'
    cs-uri-query|contains: 'next='
  selection_payload:
    cs-uri-query|contains:
      - '<script'
      - 'javascript:'
      - 'onerror='
      - 'onload='
      - 'alert('
  condition: selection_start and selection_payload
falsepositives:
  - Legitimate use of next parameter with encoded HTML entities (rare)
level: high

YARA Rule

rule CVE_2026_58491_Warpgate_XSS
{
    meta:
        description = "Detects Warpgate SSO XSS exploitation attempts in HTTP request logs or memory"
        author = "Threat Intelligence"
        date = "2026-01-01"
        reference = "CVE-2026-58491"
        severity = "critical"
    strings:
        $sso_start = "/@warpgate/api/sso/providers/"
        $sso_return = "/@warpgate/api/sso/return"
        $next_param = "next="
        $xss1 = "<script"
        $xss2 = "javascript:"
        $xss3 = "onerror="
        $xss4 = "onload="
    condition:
        any of ($sso_start, $sso_return) and $next_param and 1 of ($xss*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-58491 Warpgate SSO XSS Attempt"; flow:to_server,established; http.uri; content:"/@warpgate/api/sso/providers/"; http.uri; content:"/start"; http.uri; content:"next="; http.uri; pcre:"/next=[^&]*(%3Cscript|%3C%2Fscript|javascript%3A|onerror%3D|onload%3D)/i"; classtype:web-application-attack; sid:10000001; rev:1;)

Elastic Detection

sequence by host.id, user.id
  [ network where event.category == "network" and
    url.path : "/@warpgate/api/sso/providers/*/start" and
    url.query : "*next=*" and
    url.query : ("*<script*" or "*javascript:*" or "*onerror=*" or "*onload=*") ]

Splunk SPL Query

index=web sourcetype=warpgate:access
| search uri_path="/@warpgate/api/sso/providers/*/start" uri_query="*next=*"
| regex uri_query="(?i)next=.*?(%3Cscript|<script|javascript:|onerror=|onload=)"
| table _time, src_ip, uri_path, uri_query, status
| sort - _time

Wazuh OSSEC Rule

<group name="warpgate,web,">
  <rule id="100001" level="12">
    <decoded_as>json</decoded_as>
    <field name="url">/@warpgate/api/sso/providers/</field>
    <field name="url">/start</field>
    <field name="url">next=</field>
    <regex type="pcre2">(?i)next=.*?(%3Cscript|<script|javascript:|onerror=|onload=)</regex>
    <description>CVE-2026-58491: Warpgate SSO XSS attempt detected in next parameter</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate Mitigations:

   • Restrict network access to the Warpgate web interface to trusted IPs or VPNs only.
   • Implement a Web Application Firewall (WAF) rule to block requests containing script tags or JavaScript event handlers in the next parameter of SSO endpoints.
   • Educate users not to click on unsolicited SSO links.
   • Monitor logs for suspicious next parameter values as per detection rules above.

2. Patch/Upgrade Steps:

   • The vendor states the issue is fixed in version 0.25.5. However, no patch evidence from tracked sources is available, so verify the fix directly with the vendor. Upgrade to Warpgate 0.25.5 or later once confirmed.
   • If upgrading is not immediately possible, apply the WAF and network restrictions above.

3. Long-term Hardening:

   • Ensure all user-supplied input is properly HTML-escaped before rendering, using context-aware output encoding.
   • Implement a Content Security Policy (CSP) to mitigate XSS impact.
   • Validate and sanitize redirect destinations to prevent open redirects.
   • Regularly update Warpgate and dependencies.
   • Conduct secure code reviews focusing on output encoding and input validation.

References

• NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-58491
• Warpgate GitHub Repository: https://github.com/warp-tech/warpgate
• Warpgate Release Notes: (Check project releases for version 0.25.5)
• CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
• CISA KEV: Not listed (as of report date). No known threat actor campaigns or exploit-in-the-wild evidence available.