CVEFinder.io

CVE-2023-43660

🔶 medium
🔍 Scan for this CVE
Summary

Warpgate is a smart SSH, HTTPS and MySQL bastion host for Linux that doesn't need special client apps. The SSH key verification for a user can be bypassed by sending an SSH key offer without a signature. This allows bypassing authentication under following conditions: 1. The attacker knows the username and a valid target name 2. The attacked knows the user's public key and 3. Only SSH public key authentication is required for the user account. This issue has been addressed in version 0.8.1. User

Description

Warpgate is a smart SSH, HTTPS and MySQL bastion host for Linux that doesn't need special client apps. The SSH key verification for a user can be bypassed by sending an SSH key offer without a signature. This allows bypassing authentication under following conditions: 1. The attacker knows the username and a valid target name 2. The attacked knows the user's public key and 3. Only SSH public key authentication is required for the user account. This issue has been addressed in version 0.8.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.

CVSS Score
4.8
Medium
EPSS Score
0.0
Exploit Probability
Published Date
2023-09-27
First Seen: 2026-01-05
📊 Relative Risk Intelligence

This CVE is Lower Risk - more severe than 13.8% of all 321,566 vulnerabilities in our database.

#277,081
Below average severity
Severity Percentile
🎯 CISA SSVC Assessment Updated: Sep 20, 2024
🔍 Exploitation Status
None
No known exploits
⚙️ Automatable
NO
Requires human interaction
💥 Technical Impact
Partial
Limited system impact
SSVC data provided by CISA
Last Modified 2024-11-21
Source NVD 🔗
CVSS Vector 3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
CWE IDs (Weakness Types)
CWE-287 CWE-347

📦 Affected Products 1

Vendor Product Status Affected Versions
warpgate_project warpgate Affected
< 0.8.1

🔗 References 2

https://github.com/warp-tech/warpgate/commit/a4df7f7...
Patch
https://github.com/warp-tech/warpgate/security/advis...
Vendor Advisory

🔗 Related CVEs 6

CVE ID Severity CVSS EPSS Summary Published
CVE-2026-44347 🔶 medium 5.8 0.0 Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.23.3, the SSO flow does not validate ... 2026-05-12
CVE-2026-42189 ⚠️ high 7.5 0.2 Russh is a Rust SSH client & server library. Prior to version 0.60.1, a pre-authentication denial-of-service vulnerabili... 2026-05-08
CVE-2025-54804 🔶 medium 6.5 0.1 Russh is a Rust SSH client & server library. In versions 0.54.0 and below, the channel window adjust message of the SSH ... 2025-08-05
CVE-2024-43410 ⚠️ high 7.5 0.6 Russh is a Rust SSH client & server library. Allocating an untrusted amount of memory allows any unauthenticated user to... 2024-08-21
CVE-2023-48712 ⚠️ high 7.1 0.2 Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. In affected versions there is a privilege escala... 2023-11-24
CVE-2023-37268 🔶 medium 6.4 0.2 Warpgate is an SSH, HTTPS and MySQL bastion host for Linux that doesn't need special client apps. When logging in as a u... 2023-07-14
These CVEs affect the same products