What is the CVSS score of CVE-2026-44347?

CVE-2026-44347 has a CVSS 3.1 base score of 5.8 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:H/A:N. EPSS exploitation probability: 0.0%.

Warpgate CVE-2026-44347

MEDIUM

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-05-12 security-advisories@github.com

Information Disclosure CSRF Warpgate Warpgate Project

5.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

5.8 MEDIUM

AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:H/A:N

vuln.today AI

5.8 MEDIUM

Attacker must hold own account (PR:L), victim must act on crafted link (UI:R), high complexity for OAuth timing; scope change (S:C) as victim acts on attacker-owned targets with high integrity consequence.

3.1 AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:H/A:N

4.0 AV:N/AC:H/AT:P/PR:L/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 19:03 vuln.today

CVE Published

May 12, 2026 - 23:16 nvd

MEDIUM 5.8

DescriptionGitHub Advisory

Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.23.3, the SSO flow does not validate the state parameter, which makes it possible for an attacker to trick a user into logging into the attacker's account, possibly convincing them to perform sensitive actions on the attacker's account (such as writing sensitive data to the attacker's SSH target, or logging into an HTTP target that the attacker set up). This vulnerability is fixed in 0.23.3.

AnalysisAI

SSO login flow in Warpgate bastion host prior to 0.23.3 omits validation of the OAuth state parameter, enabling a cross-site request forgery attack that forces a victim to authenticate into the attacker's account instead of their own. Once logged in as the attacker, the victim may unknowingly write sensitive data to attacker-controlled SSH targets or interact with attacker-configured HTTP targets, resulting in high integrity impact with scope change. No confirmed active exploitation (not in CISA KEV), though SSVC assessment indicates a proof-of-concept exists; EPSS at 0.01% reflects low real-world exploitation probability at time of analysis.

Technical ContextAI

Warpgate is an open-source Linux-based bastion host supporting SSH, HTTPS, and MySQL protocols (cpe:2.3:a:warpgate_project:warpgate:0.23.2:*:*:*:*:*:*:*). The vulnerability resides in its SSO authentication flow, which implements an OAuth 2.0/OpenID Connect authorization code flow. RFC 6749 mandates that the client generate and validate a cryptographically random state parameter to bind the authorization request to the callback and prevent cross-site forgery of the redirect. Warpgate's pre-0.23.3 implementation omits this binding check, allowing an attacker to craft a stolen or manipulated OAuth callback URL and deliver it to a victim. CWE-352 (Cross-Site Request Forgery) is the root cause: the server-side callback handler accepts any incoming state without verifying it was issued by the user's own browser session, making it trivially forgeable.

RemediationAI

Vendor-released patch: Warpgate 0.23.3 introduces proper OAuth state parameter validation and is the definitive fix. Administrators should upgrade to 0.23.3 or any later release as the primary remediation. Full advisory and release details are at https://github.com/warp-tech/warpgate/security/advisories/GHSA-rj86-hm3r-c275. If an immediate upgrade is operationally infeasible, the most effective compensating control is to disable SSO login in the Warpgate configuration and require users to authenticate via local credentials or other non-OAuth methods until the upgrade is applied - this eliminates the vulnerable code path entirely. The trade-off is the loss of SSO convenience and any IdP-enforced policy such as MFA; administrators must weigh this against the attack feasibility given that PR:L and UI:R both limit opportunistic exploitation. Additionally, user awareness training to avoid clicking unexpected login links during an active Warpgate session reduces phishing delivery success.