A missing authorization vulnerability in Warpgate allows authenticated users to eavesdrop on sensitive SSH, MySQL, and PostgreSQL session traffic, posing a severe risk to system confidentiality.

The application fails to enforce administrative permission requirements for the WebSocket endpoint used to stream session recordings. Consequently, any authenticated user can subscribe to active sessions and intercept sensitive input and output, including credentials and commands.

The exploitation of this vulnerability leads to the unauthorized disclosure of sensitive administrative and user credentials, which can facilitate lateral movement and further compromise of the internal infrastructure. With a CVSS score of 7.7, this flaw represents a significant risk to the integrity of bastion host security, potentially exposing the entire proxied environment to malicious actors.

Immediate Action: Update Warpgate to version 0.25.6 or later to enforce the required AdminPermission::RecordingsView authorization check.

Proactive Monitoring: Review access logs for unauthorized attempts to access the /@warpgate/admin/api/recordings/ endpoint and monitor WebSocket connection patterns for anomalies.

Compensating Controls: Implement network-level restrictions or Web Application Firewall (WAF) rules to limit access to the Warpgate administrative API to trusted IP addresses only.

Public Exploit Available: Unknown.

Given the potential for mass credential exposure and session hijacking, organizations utilizing Warpgate as a bastion host must prioritize this update. Administrators should verify their current deployment version immediately and apply the patch to ensure administrative API calls are properly protected against unauthorized access.