← Vulnerability feed

Vulnerability record · CVE-2023-43660 · published 27 September 2023

CVE-2023-43660: Warpgate project warpgate improper authentication vulnerability

Warpgate Project · Warpgate

Warpgate is a smart SSH, HTTPS and MySQL bastion host for Linux that doesn't need special client apps. The SSH key verification for a user can be bypassed by sending an SSH key offer without a signature. This allows bypassing authentication under following conditions: 1. The attacker knows the username and a valid target name 2. The attacked knows the user's public key and 3. Only SSH public key authentication is required for the user account. This issue has been addressed in version 0.8.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.

8.1 CVSS 3.1 High EPSS 0.25% · top 84.9% CWE-287 · Improper authenticationCWE-347 · Improper verification of cryptographic signature
8.1CVSS 3.1 base score
0.25%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
4References
17 Jun 2026Last modified by NVD

Description

Warpgate is a smart SSH, HTTPS and MySQL bastion host for Linux that doesn't need special client apps. The SSH key verification for a user can be bypassed by sending an SSH key offer without a signature. This allows bypassing authentication under following conditions: 1. The attacker knows the username and a valid target name 2. The attacked knows the user's public key and 3. Only SSH public key authentication is required for the user account. This issue has been addressed in version 0.8.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/warp-tech/warpgate/commit/a4df7f7a21395cfaee7a9789d1e3846290caeb63 Patch
https://github.com/warp-tech/warpgate/security/advisories/GHSA-3cjp-w4cp-m9c8 Vendor Advisory
https://github.com/warp-tech/warpgate/commit/a4df7f7a21395cfaee7a9789d1e3846290caeb63 Patch
https://github.com/warp-tech/warpgate/security/advisories/GHSA-3cjp-w4cp-m9c8 Vendor Advisory

Track CVE-2023-43660 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.8CVE-2023-48712Warpgate project warpgate incorrect authorization vulnerabilityWarpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. In affected versions there is a privilege escalation vulnerability through a …EPSS 0.68%8.8CVE-2023-37268Warpgate project warpgate improper authentication vulnerabilityWarpgate is an SSH, HTTPS and MySQL bastion host for Linux that doesn't need special client apps. When logging in as a user with SSO enabled an attac…EPSS 0.55%7.5CVE-2026-42189Russh project russh allocation without limits vulnerabilityRussh is a Rust SSH client & server library. Prior to version 0.60.1, a pre-authentication denial-of-service vulnerability exists in the server's key…EPSS 0.76%7.5CVE-2024-43410Russh project russh allocation without limits vulnerabilityRussh is a Rust SSH client & server library. Allocating an untrusted amount of memory allows any unauthenticated user to OOM a russh server. An SSH p…EPSS 0.91%6.5CVE-2026-44347Warpgate project warpgate cross-site request forgery vulnerabilityWarpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.23.3, the SSO flow does not validate the state parameter, which ma…EPSS 0.16%6.5CVE-2025-54804Russh project russh integer overflow vulnerabilityRussh is a Rust SSH client & server library. In versions 0.54.0 and below, the channel window adjust message of the SSH protocol is used to track the…EPSS 0.40%7.5CVE-2026-42018JFrog Artifactory improper authentication leaks anonymous tokenJFrog Artifactory can return an internal anonymous-user token to an unauthenticated caller even when anonymous access is disabled. Because the token …KEVEPSS 9.8%analysed9.8CVE-2026-82329JFrog Artifactory improper authentication allows admin takeoverJFrog Artifactory contains an improper authentication weakness (CWE-287) that, under default configuration, may let an unauthenticated attacker with …KEVEPSS 14%analysed

Source: NIST National Vulnerability Database (record CVE-2023-43660), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.