High severity · published Sep 27, 2023
CVE-2023-43660
SSH key password bypassed in warpgate
8.1
CVSS
0.3%
EPSS
No
On KEV
Description
Warpgate is a smart SSH, HTTPS and MySQL bastion host for Linux that doesn't need special client apps. The SSH key verification for a user can be bypassed by sending an SSH key offer without a signature. This allows bypassing authentication under following conditions: 1. The attacker knows the username and a valid target name 2. The attacked knows the user's public key and 3. Only SSH public key authentication is required for the user account. This issue has been addressed in version 0.8.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 23% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WA
warpgate · warp-tech
< 0.8.1 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-43660
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-43660
Patch
https://github.com/warp-tech/warpgate/commit/a4df7f7a21395cfaee7a9789d1e3846290caeb63
Vendor Advisory
https://github.com/warp-tech/warpgate/security/advisories/GHSA-3cjp-w4cp-m9c8
More from warpgate
9.3
CVE-2026-58491
Warpgate: Reflected XSS in SSO return endpoint via attacker-controlled next parameter
8.8
CVE-2023-48712
User authorization bug leading to privilege escalation in warpgate
7.7
CVE-2026-63330
Warpgate: Missing Admin Authorization on Live Recording Stream WebSocket Allows Any Authenticated User to Eavesdrop on Terminal Sessions
6.5
CVE-2026-44347
Warpgate: SSO CSRF -- State Token Not Validated on Return
6.0
CVE-2026-91167
Warpgate: Missing authorization check on `PUT /users/:id/roles/:role_id` allows any admin to bypass the `AccessRolesAssign` permission boundary