CVE-2026-63330

Executive Summary

CVE-2026-63330 is a broken authorization vulnerability in Warpgate, an open source SSH, HTTPS, and MySQL bastion host for Linux. Prior to version 0.25.6, the WebSocket endpoint used to stream session recordings is protected only by session authentication and omits the administrative permission check (AdminPermission::RecordingsView), allowing any authenticated non-privileged user who can identify an active recording UUID to subscribe to live terminal input and output. This exposes real-time commands, credentials, and other sensitive data from proxied SSH, MySQL, and PostgreSQL sessions, including those belonging to administrators.

Technical Analysis

Warpgate acts as a bastion host that proxies administrative and database access (SSH, HTTPS, MySQL, PostgreSQL) and records sessions for audit and review. Recordings are exposed to operators through an admin API namespace under /@warpgate/admin/api/. The specific handler named in the description, api_get_recording_stream in warpgate-admin/src/api/recordings_detail.rs, is responsible for serving the live recording stream over WebSocket at the route /@warpgate/admin/api/recordings/{uuid}/stream.

The root cause is a missing authorization check (CWE-285, Improper Authorization). The endpoint enforces only session authentication: a caller must be a logged-in user. It does not invoke the authorization guard for the administrative permission AdminPermission::RecordingsView, which every other recording-management endpoint in the admin API applies. As a result, the route is effectively available to the entire authenticated user population rather than to administrators holding the recordings-view permission.

The access control model is therefore broken at the object level: possession of a valid session plus knowledge of a recording UUID is sufficient to reach the stream. Because the endpoint is a WebSocket upgrade rather than a conventional read of a stored file, it delivers data as it is generated — real-time terminal input and output from the proxied session. The CVE states plainly that an attacker can receive real-time terminal input and output from proxied SSH, MySQL, or PostgreSQL sessions, including credentials, commands, and other sensitive data belonging to users and administrators of the bastion.

Two conditions define the exposure surface. First, the target recording must be active: the description refers to subscribing to a live recording's WebSocket, so the attack window is the period during which a session is being recorded. Second, the attacker must identify the recording — a UUID that is not secret in the sense of being cryptographically derived, but that functions as an unguessable object identifier. The vulnerability is not a brute-forceable secret disclosure; it is a missing permission gate that a privileged-but-unchecked user can bypass once the object identifier is known or observed.

The scope metric in the CVSS vector (S:C) reflects that the impacted security authority extends beyond the vulnerable component: exploitation leaks data belonging to other users and administrators, crossing the boundary between the low-privileged account and the sessions it is not authorized to observe. The confidentiality impact is High and integrity and availability impacts are None, consistent with a pure disclosure flaw.

No public proof-of-concept, Nuclei template, or exploit code is known for this issue. The technical mechanics above are derived directly from the NVD description; no additional function names, routes, or parameters beyond those stated should be assumed.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class (improper authorization / missing permission check on a privileged streaming endpoint) and the details stated in the NVD description.

1. Reconnaissance / target identification. The attacker first obtains a valid low-privileged account on the Warpgate instance. This is the baseline requirement (CVSS PR:L). They then need to identify an active recording: a recording UUID for a session currently in progress. Reconnaissance focuses on the admin API namespace /@warpgate/admin/api/recordings/, where recording list/detail endpoints may be reachable to authenticated users, and on any means of learning UUIDs — for example, browsing the recordings index within the authenticated UI, observing UUIDs in application traffic, or leveraging any other recording endpoint that the same account can already reach. The essential point is that the attacker needs a UUID for a live session, not the ability to guess one.

2. Triggering the flaw. With the UUID in hand, the attacker initiates a WebSocket connection to the endpoint /@warpgate/admin/api/recordings/{uuid}/stream. Because the handler api_get_recording_stream validates only the session and never calls the guard for AdminPermission::RecordingsView, the connection is accepted. The missing permission check — not any malformed request, injection, or memory corruption — is what enables the bypass. The attacker is simply authenticated; no additional privilege or exploit payload is required.

3. Execution / data capture. Once the WebSocket is established, the attacker receives the live stream of terminal input and output for the target session. This is passive capture: the attacker observes what the proxied user types and what the remote system returns. There is no command execution by the attacker in this step. The payload is therefore the steady flow of recorded keystrokes and output from the proxied SSH, MySQL, or PostgreSQL session.

4. Post-exploitation impact. The captured stream can contain credentials entered at the terminal or in database client prompts, executed commands, query results, and other sensitive data belonging to the session's owner — which may be an administrator. The attacker can use disclosed credentials to pivot into downstream systems, learn the environment's topology and secrets, and correlate the exposed administrator activity with further targets. Because the data is real-time, credential harvesting can be performed the moment a privileged user authenticates or runs a sensitive command, making timing the only constraint on what is captured.

Impact Assessment

The CVSS 3.1 base score is 7.7 (High) with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N. The subscores describe the exposure precisely:

• Attack Vector — Network (AV:N). The endpoint is reachable over the network; no local or adjacent access is required.
• Attack Complexity — Low (AC:L). No special conditions, race windows, or defense bypass techniques are needed. Authentication as a regular user plus a known UUID is sufficient.
• Privileges Required — Low (PR:L). The attacker needs only a valid, non-administrative account. This is a low bar on most bastion deployments, where many operators hold standard accounts.
• User Interaction — None (UI:N). The victim administrator or user does not need to click anything; the attacker's own WebSocket subscription is the only action.
• Scope — Changed (S:C). The exploited component (the admin recording API) grants access to data owned by other security principals (other users and administrators), so the impact crosses an authorization boundary.
• Confidentiality — High (C:H). Terminal input/output can include credentials, commands, and database results — the highest-value data in a bastion environment. This is a direct exposure of the secrets a bastion exists to protect.
• Integrity / Availability — None (I:N/A:N). The attacker does not modify recordings or disrupt service; the harm is purely disclosure.

Blast radius and business impact. Warpgate is positioned as the central control point through which administrators reach production Linux systems and through which database sessions to MySQL and PostgreSQL are proxied. A successful exploitation therefore does not grant access to one machine; it can expose the credentials and actions of every user whose session is streamed while the attacker is listening. Because administrators are among the highest-value targets, captured credentials can enable lateral movement into privileged infrastructure, and captured database queries can reveal sensitive records — regulated data, customer information, secrets — in transit. The flaw is a full audit-boundary failure: the logging system that exists to create accountability instead becomes a data-exfiltration channel for any authenticated insider or compromised low-privileged account.

The absence of a CISA KEV listing and the lack of public exploit code suggest the issue is not yet being mass-exploited, but the low attack complexity and the value of the exposed data make it attractive for insider threats, red-team objectives, and adversaries who already hold any credential in the environment.

Detection Guidance

Sigma Rule

title: Warpgate Unauthorized Recording Stream Access (CVE-2026-63330)
id: 4e1c9f8a-77b2-4a2d-b0a1-cve202663330
status: experimental
description: Detects access to the Warpgate admin recording stream WebSocket endpoint by non-administrative sessions. Correlation with user role is required in the SIEM.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-63330
author: Threat Intelligence
date: 2026/01/01
logsource:
  category: web
  product: warpgate
detection:
  selection_endpoint:
    cs-uri-stem|contains: '/@warpgate/admin/api/recordings/'
  selection_stream:
    cs-uri-stem|endswith: '/stream'
  selection_upgrade:
    cs-method: 'GET'
    cs-headers|contains: 'Upgrade: websocket'
  condition: selection_endpoint and selection_stream and selection_upgrade
fields:
  - c-ip
  - cs-username
  - cs-uri-stem
falsepositives:
  - Legitimate administrators with AdminPermission::RecordingsView opening live recordings
level: high
tags:
  - attack.t1078
  - cve.2026.63330

YARA Rule

rule CVE_2026_63330_Warpgate_Unauthorized_Recording_Stream
{
    meta:
        description = "Detects Warpgate recording stream access patterns associated with CVE-2026-63330 in HTTP/proxy logs and configs"
        author = "Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-63330"
        date = "2026-01-01"
        severity = "high"

    strings:
        $ep1 = "/@warpgate/admin/api/recordings/" ascii wide
        $ep2 = "/stream" ascii wide
        $ws  = "Upgrade: websocket" ascii wide nocase
        $hb  = "api_get_recording_stream" ascii wide
        $perm = "AdminPermission::RecordingsView" ascii wide

    condition:
        (uint16(0) != 0x5A4D) and
        (
            (any of ($ep1) and any of ($ep2)) or
            $hb or $perm
        )
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-63330 Warpgate unauthorized recording stream access attempt"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/@warpgate/admin/api/recordings/"; http.uri; content:"/stream"; http.header; content:"Upgrade: websocket"; nocase; reference:cve,2026-63330; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-63330; classtype:attempted-user; sid:202663330; rev:1;)

Elastic Detection

sequence by source.ip, user.name with maxspan=5m
  [http where http.request.method == "GET" and
     http.request.path : "/@warpgate/admin/api/recordings/*" and
     http.request.path : "*/stream"]
  [network where network.protocol == "websocket" and
     url.path : "/@warpgate/admin/api/recordings/*/stream"]

Splunk SPL Query

index=proxy OR index=web sourcetype=access_combined OR sourcetype=warpgate:access
| search cs_uri_stem="/@warpgate/admin/api/recordings/*/stream"
| eval is_ws=if(like(_raw, "%Upgrade: websocket%"), 1, 0)
| where is_ws=1
| stats count min(_time) as first_seen max(_time) as last_seen values(cs_uri_stem) as endpoints by src_ip, user
| where count > 0
| table first_seen, last_seen, src_ip, user, count, endpoints

Wazuh OSSEC Rule

<group name="warpgate,web,cve-2026-63330,">
  <rule id="202663330" level="12">
    <decoded_as>web-accesslog</decoded_as>
    <url>/@warpgate/admin/api/recordings/</url>
    <regex type="pcre2">/@warpgate/admin/api/recordings/[^/]+/stream</regex>
    <description>CVE-2026-63330: Possible unauthorized access to Warpgate recording stream WebSocket endpoint</description>
    <mitre>
      <id>T1078</id>
    </mitre>
    <group>cve_2026_63330,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). The NVD description states the issue is fixed in version 0.25.6, but no tracked patch source confirms it; treat affected deployments as exposed until the upgrade is verified in your environment.

1. Immediate mitigations.

   • Restrict network access to the Warpgate admin API namespace (/@warpgate/admin/api/) so that only trusted administrative networks or jump hosts can reach it; the recording stream is the specific route of concern.
   • At the reverse proxy or WAF in front of Warpgate, deny or challenge requests to /@warpgate/admin/api/recordings/{uuid}/stream that originate from sessions not belonging to administrative users, if your proxy can enforce that distinction.
   • Reduce the number of accounts that can reach the admin namespace at all, and audit the current user population for non-administrative accounts with API access.
   • If administrative recording live-streaming is not operationally required, disable the live-stream feature at the proxy layer (block the /stream route) as a stopgap while still permitting stored recording review through other paths.
   • Rotate any credentials that may have been captured during a suspected exposure window, and treat captured credentials as compromised.

2. Patch / upgrade steps.

   • Upgrade Warpgate to version 0.25.6 or later, which the advisory states contains the fix.
   • Because patch confidence is 0/4, validate the upgrade independently: confirm the recording stream endpoint now enforces the recordings-view permission by testing it with a non-administrative account and verifying the WebSocket subscription is rejected.
   • After upgrade, review Warpgate release notes and any vendor advisory for confirmation of the authorization fix and for any additional hardening guidance.
   • Re-baseline your recordings feature exposure: confirm which roles retain access to recordings and that the permission AdminPermission::RecordingsView is applied consistently across all recording endpoints.

3. Long-term hardening.

   • Enforce least privilege on the admin API: every privileged route should require an explicit permission check, and this case demonstrates the value of automated tests that assert permission enforcement on each admin endpoint.
   • Deploy continuous authorization testing (negative tests) in CI for the admin API surface, specifically asserting that endpoints requiring a permission fail closed for users lacking it.
   • Segment the Warpgate management plane from general network access, and log all admin API access with source identity for retrospective detection.
   • Monitor recording UUID disclosure paths so that object identifiers for live sessions are not broadly visible to unprivileged users.
   • Maintain an inventory of exposed bastion/remote-access management interfaces (Warpgate among others) and subscribe to vendor advisories for timely patching.

References

• NVD — CVE-2026-63330: https://nvd.nist.gov/vuln/detail/CVE-2026-63330
• Warpgate project (official source / release notes for 0.25.6): https://github.com/warp-tech/warpgate
• MITRE ATT&CK — T1078 Valid Accounts: https://attack.mitre.org/techniques/T1078/
• CWE-285 — Improper Authorization: https://cwe.mitre.org/data/definitions/285.html
• CISA Known Exploited Vulnerabilities Catalog (no entry for CVE-2026-63330 as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No known threat actor campaigns or exploit-in-the-wild evidence are associated with CVE-2026-63330 at the time of writing. No public proof-of-concept, exploit code, or Nuclei template is available; the attack chain above is assessed from the vulnerability class and the NVD description.