Security fixes

Moderate GHSA-fxfw-2m4j-xmc8 - Kubernetes approval for one API token authorizes a different token of the same user

Suggested action: upgrade if using Kubernetes targets with approvals via token authentication

When approval grace period is enabled and an approval for a Kubernetes target is remembered, it becomes valid for all tokens of that user instead and not just the token the approval was given for.

High GHSA-hhq8-x2xc-95qx - HTTP proxy follows cross-host redirects from upstream targets

Suggested action: upgrade if using untrusted/user-controlled HTTP targets

Warpgate follows HTTP redirects sent by the target, allowing SSRF by a malicious target.

Moderate GHSA-r7rf-j762-2xxv - MySQL/Postgres unencrypted auth methods used without TLS in TLS Preferred mode

Suggested action: set an explicit TLS mode (enabled/disabled)

When TLS mode is set to "Preferred" and the target does not offer TLS, Warpgate would still accept plaintext authentication if it's the only available and supported auth mechanism.

Full Changelog: v0.30.3...v0.30.4

Fixes

• fixed #2865 - SSH command audit truncates the command when Enter is pressed with the cursor mid-line

Full Changelog: v0.30.2...v0.30.3

Features

• RDP now shows remote cursor shape, by @DevNico in #2776
• Sessions are now immediately aborted when the corresponding role assignment is revoked, by @vdhome-dev in #2789

Fixes

• fixed #2828 - HTTP targets: compressed responses are now passed through to the browser instead of being decompressed in 2c16c18
• MySQL: ticket secrets and cleartext passwords no longer appear in the handshake trace log by @thoro in #2624
• Admin approvals: a timed-out approval request is now settled before the session is closed, so a decision made at the last moment is honoured and the request leaves the queue immediately, in #2830
• zstd-safe updated to 8.2 in 397dec2

New Contributors

• @DevNico made their first contribution in #2776
• @vdhome-dev made their first contribution in #2789
• @thoro made their first contribution in #2624

Full Changelog: v0.30.1...v0.30.2

Security fixes

GHSA-hp22-gfvj-7m8r - MySQL proxy: authenticated memory exhaustion via unbounded max_packet_size - eee3915

Malicious target could cause an unbounded memory allocation

GHSA-cj29-mv44-r3g2 - is_localhost_host matches arbitrary 127.* DNS domains (post-SSO open redirect & control_plane_host bypass) and MFA+SSO drops SsoLoginState - d466f3c

Accessing a bound target domain matching the 127.* pattern would disable some security protections

GHSA-rccx-x2f2-qggp - The SSH target menu connects with a stale copy of the target, bypassing approval enabled while the menu is open

Target role changes made while a user already has the SSH target selection menu open would not affect their session.

GHSA-wv8f-pg5h-j86g - The Kubernetes proxy follows upstream redirects, fetching internal URLs from Warpgate's network position - acdf746

A malicious authenticated user with Kubernetes target access could perform arbitrary HTTP requests from Warpgate's network position.

GHSA-9cmw-ff3v-ggc9 - Single-target HTTP ticket sessions can attach to or terminate the owner's WebSSH/WebDesktop sessions and read SSO Kubernetes OIDC secrets - 2bebdf9

HTTP tickets were not restricted from controlling user's own WebSSH / Web desktop sessions and fetching Kubernetes OIDC secrets.

GHSA-2xj4-4766-4xwx - HTTP proxy forwards client-supplied X-Forwarded-For, X-Forwarded-Host, and X-Forwarded-Proto headers ahead of Warpgate's own headers - 90472d2

Client-supplied X-Forwarded-* headers were not stripped when forwarding to an HTTP target

GHSA-jgwh-2q6f-w7g6 - Login protection brute-force rate limiting bypass via Condition::any() in clear_failed_attempts - 21636e7

An authenticated user could bypass brute-force protection while bruteforcing another user's password.

Security hardening

• Secret references: mount and path segments are now validated by @mtthsbrd in #2815
• Ticket activation is now atomic, so concurrent requests can't use the same ticket more than once, by @mtthsbrd in #2818
• VNC: Tight compact-length bounds and the Apple DH public key range are now validated by @mtthsbrd in #2819
• Web UI: config warnings are no longer rendered as raw HTML, and target URLs and kubeconfig contents are now escaped, by @mtthsbrd in #2817
• Docker: trust roots updated for the eMudhra intermediate distrust by @SachinMaharana in #2775

Fixes

• fixed #2765 - web SSH opened two shell channels per session by @monsterlag in #2778
• SSH: the target list is reloaded when connecting from the interactive menu in 6dd8d23
• Kubernetes: watch streams are no longer buffered, and percent-encoded paths are decoded correctly in eea30c7
• OIDC: logout state is now stored earlier in the flow in 43acddf
• The Vault/OpenBao client now uses the OS trust store in a5773ca

Changes

• Accessibility: secondary text and field borders now meet WCAG AA contrast by @a1kudryavtsev in #2793 and #2794
• Database targets in the portal can now be reached with the keyboard by @a1kudryavtsev in #2801
• Users without any targets are now told who can grant them access by @a1kudryavtsev in #2804
• The profile page now explains empty credential sections by @a1kudryavtsev in #2803
• UI copy: page titles shortened to fit on phones, consistent title case, and one shared table of target kind labels by @a1kudryavtsev in #2799, #2798 and #2811
• Session IDs are now shortened in the log by @a1kudryavtsev in #2808

New Contributors

• @monsterlag made their first contribution in #2773
• @a1kudryavtsev made their first contribution in #2793

Full Changelog: v0.30.0...v0.30.1

Major new features

HashiCorp Vault / OpenBao secret backends - #2185

Support for fetching passwords and private keys from a Vault-compatible backend without storing them in the database.

Backends are configured under Config → Secret backends.

^{by @Simonn21}

Vault/OpenBao-signed SSH certificates for target authentication - #2734

SSH targets can now authenticate with a short-lived OpenSSH certificate signed per connection by a Vault / OpenBao secret backend.

^{by @janisdombr}

OIDC back-channel logout - #2740

Warpgate now accepts OpenID Connect Back-Channel Logout requests at /@warpgate/api/sso/providers/<name>/backchannel-logout. When the identity provider signs a user out, it ends their Warpgate sessions on every cluster node. The new disable_local_logout provider option hides Warpgate's own "log out" button when the provider supports single logout.

Custom logo - #2696

Upload your own logo under Config → Parameters

Features

• Graphics Pipeline (RDPEGFX) support for RDP - RDP now negotiates the Graphics Pipeline extension with RemoteFX Progressive and ClearCodec. Adds support for GNOME Remote Desktop and KRDP by @askz in #2621
• SSH: new ssh.target_handshake_timeout config option for targets that accept the TCP connection but never complete the handshake @boenshao in #2641
• fixed #2695 - fuzzy search in the target list in #2714

Security fixes

Moderate GHSA-qcwp-cwqv-g428 - a hostile HTTP target can trigger actions in an active admin's session

A malicious HTTP target could send POST requests to Warpgate API endpoints when accessed by a logged-in admin user.

• Cross-site requests to Warpgate's own API are rejected: state-changing and WebSocket requests to /@warpgate must originate from the control plane host itself (sibling target subdomains no longer count), and sessions on target hosts are limited to the login/logout and MFA endpoints. The UI redirects to the control plane host (http.external_host, falling back to external_host) for those flows

Moderate GHSA-fhwh-r27p-hvg5 - TOTP MFA policy not enforced unless the user's own policy specifies both factors

When a user had an explicit auth policy that did not require MFA, the global MFA policy did not apply to this user. Additionally, a user having both a TOTP credential and a "any credential" policy would be interpreted literally and allow authentication with OTP alone. Now, OTP credentials by themselves are never considered to be sufficient for login.

Moderate GHSA-rm54-2mgh-59g9 - a hostile VNC or RDP target can trigger an unbounded memory allocation

Hostile VNC/RDP targets could report excessive desktop resolutions and trigger unbounded allocations in Warpgate.

Low GHSA-2cwg-f83j-xjgx - HTTP target headers and URL credentials are returned to admins without TargetsEdit

HTTP target header values and the basic auth credentials in the URL are now additionally blanked out for limited admin users without the TargetsEdit permission.

Low GHSA-g5wc-qprw-44ph - ?warpgate-ticket= authenticates the existing HTTP session without rotating its ID

• Using a valid ticket in an existing HTTP session now automatically rotates its key as a defense-in-depth against session fixation attacks

Changes

• Docker: the runtime image is now based on gcr.io/distroless/cc-debian12 (no shell, no package manager), which removes 60+ scanner CVEs from OS packages Warpgate never used. The warpgate user (UID 1000) and /data volume are unchanged by @mtthsbrd in #2705
• fixed #2548 - RDP, VNC and web SSH now show users a fixed phrase when the target connection fails instead of the raw error in #2729
• Closing a session (admin close, user deletion) now also aborts its pending approvals in c73ca3c
• Cluster peers are authenticated via mTLS instead of a static cluster token in #2698
• Web SSH and desktop clients now show connection progress state (waiting for approval, connecting, connected) in #2684
• Large target lists in the gateway UI are now virtualized (#2642) in #2650
• fixed #2633 - the S3 recordings scratch directory is configurable (scratch_path) by @mathieuHa in #2634
• Helm: overrides_config is rendered through tpl, so it can reference other chart values by @vitaly-sinev in #2673

Fixes

• fixed #2658 - SSH port forwarding for RDP with ssh -N was dropped immediately because the forwarded data was mistaken for Ctrl-C by @megative in #2679
• HTTP: query parameters are forwarded to the target verbatim; since 0.27.0 they were re-encoded, breaking upstreams that put opaque data (e.g. bare base64) in the query by @Mac898 in #2704
• fixed #2702 - web approvals satisfied by the grace period no longer show up as pending in the admin UI in #2719
• fixed #2627 - Kubernetes: upstream API clients are reused across requests instead of opening a new connection and TLS handshake for every proxied request by @sthalbert in #2628
• Kubernetes: requests are resent when the upstream TCP connect or TLS handshake fails, instead of returning a 500 to kubectl in #2718
• Kubernetes: closing a session (admin close, user deletion) now actually ends its in-flight exec/attach/port-forward and watch/log streams in #2720
• SSH public keys added through the user profile had their comment stored, which made login with that key fail by @fergusean in #2666
• Recordings were marked complete before all of their streams had finished uploading (S3) in #2652
• Adding a TOTP credential through the admin API now updates the user's credential policy to require it, as the UI already did in f8590e2
• VNC: target connect and handshake are now bounded by the same 10s / 30s deadlines as RDP in 8de78f5
• Admin UI: the search box did nothing on the Admin roles and Target groups pages in 1c16a9f
• API tokens: expiry picker used UTC instead of local time, treated the preset as milliseconds and showed the maximum in whole days only in 2a2c2c4

Security hardening

• Target credentials are now redacted in the admin API responses for admins without the Targets Edit permission in #2685
• The session cookie is now always marked Secure by @mtthsbrd in #2675
• Added X-Content-Type-Options: nosniff, Referrer-Policy: same-origin and X-Frame-Options: SAMEORIGIN headers by @mtthsbrd in #2676
• X-Forwarded-For / -Host / -Proto now use the last value and ignore invalid values in 1d41778

New Contributors

• @Simonn21 made their first contribution in #2185
• @sthalbert made their first contribution in #2628
• @megative made their first contribution in #2679
• @vitaly-sinev made their first contribution in #2673
• @askz made their first contribution in #2621
• @k176060444-lgtm made their first contribution in #2669
• @Mac898 made their first contribution in #2704
• @boenshao made their first contribution in #2641

Full Changelog: v0.29.2...v0.30.0

Major new features

OIDC back-channel logout - #2740

Warpgate now accepts OpenID Connect Back-Channel Logout requests at /@warpgate/api/sso/providers/<name>/backchannel-logout. When the identity provider signs a user out, it ends their Warpgate sessions on every cluster node. The new disable_local_logout provider option hides Warpgate's own "log out" button when the provider supports single logout.

Full Changelog: v0.30.0-beta.2...v0.30.0-beta.3

Major new features

Vault-signed SSH certificates for target authentication - #2734

SSH targets can now authenticate with a short-lived OpenSSH certificate signed per connection by a Vault / OpenBao secret backend.

^{by @janisdombr}

Changes

• SSH: new ssh.target_handshake_timeout config option for targets that accept the TCP connection but never complete the handshake @boenshao in #2641
• Docker: the runtime image is now based on gcr.io/distroless/cc-debian12 (no shell, no package manager), which removes 60+ scanner CVEs from OS packages Warpgate never used. The warpgate user (UID 1000) and /data volume are unchanged by @mtthsbrd in #2705
• fixed #2548 - RDP, VNC and web SSH now show users a fixed phrase when the target connection fails instead of the raw error in #2729
• Closing a session (admin close, user deletion) now also aborts its pending approvals in c73ca3c
• Admin UI: fuzzy search ranking in the target list in 5ea7dcc

Fixes

• VNC: target connect and handshake are now bounded by the same 10s / 30s deadlines as RDP in 8de78f5
• Admin UI: the search box did nothing on the Admin roles and Target groups pages in 1c16a9f
• API tokens: expiry picker used UTC instead of local time, treated the preset as milliseconds and showed the maximum in whole days only in 2a2c2c4

New Contributors

• @boenshao made their first contribution in #2641

Full Changelog: v0.30.0-beta.1...v0.30.0-beta.2

Major new features

HashiCorp Vault / OpenBao secret backends - #2185

Support for fetching passwords and private keys from a Vault-compatible backend without storing them in the database.

Backends are configured under Config → Secret backends.

^{by @Simonn21}

Graphics Pipeline (RDPEGFX) support for RDP - #2621

RDP now negotiates the Graphics Pipeline extension with RemoteFX Progressive and ClearCodec. Adds support for GNOME Remote Desktop and KRDP.

^@askz

Custom logo - #2696

Upload your own logo under Config → Parameters

Changes

• Cluster peers are authenticated via mTLS instead of a static cluster token in #2698
• fixed #2695 - fuzzy search in the target list in #2714
• Web SSH and desktop clients now show connection progress state (waiting for approval, connecting, connected) in #2684
• Large target lists in the gateway UI are now virtualized (#2642) in #2650
• fixed #2633 - the S3 recordings scratch directory is configurable (scratch_path) by @mathieuHa in #2634
• Helm: overrides_config is rendered through tpl, so it can reference other chart values by @vitaly-sinev in #2673

Security hardening

• Target credentials are now redacted in the admin API responses for admins without the Targets Edit permission in #2685
• The session cookie is now always marked Secure by @mtthsbrd in #2675
• Added X-Content-Type-Options: nosniff, Referrer-Policy: same-origin and X-Frame-Options: SAMEORIGIN headers by @mtthsbrd in #2676
• X-Forwarded-For / -Host / -Proto now use the last value and ignore invalid values in 1d41778

Fixes

• fixed #2658 - SSH port forwarding for RDP with ssh -N was dropped immediately because the forwarded data was mistaken for Ctrl-C by @megative in #2679
• HTTP: query parameters are forwarded to the target verbatim; since 0.27.0 they were re-encoded, breaking upstreams that put opaque data (e.g. bare base64) in the query by @Mac898 in #2704
• fixed #2702 - web approvals satisfied by the grace period no longer show up as pending in the admin UI in #2719
• fixed #2627 - Kubernetes: upstream API clients are reused across requests instead of opening a new connection and TLS handshake for every proxied request by @sthalbert in #2628
• Kubernetes: requests are resent when the upstream TCP connect or TLS handshake fails, instead of returning a 500 to kubectl in #2718
• Kubernetes: closing a session (admin close, user deletion) now actually ends its in-flight exec/attach/port-forward and watch/log streams in #2720
• SSH public keys added through the user profile had their comment stored, which made login with that key fail by @fergusean in #2666
• Recordings were marked complete before all of their streams had finished uploading (S3) in #2652
• Adding a TOTP credential through the admin API now updates the user's credential policy to require it, as the UI already did in f8590e2

New Contributors

• @Simonn21 made their first contribution in #2185
• @sthalbert made their first contribution in #2628
• @megative made their first contribution in #2679
• @vitaly-sinev made their first contribution in #2673
• @askz made their first contribution in #2621
• @k176060444-lgtm made their first contribution in #2669
• @Mac898 made their first contribution in #2704

Full Changelog: v0.29.1...v0.30.0-beta.1

Fixes

• Fix intermittent SSO login errors when the OIDC provider rotates its signing keys

Fixes

• fixed #2613 - approval could not be remembered when web approval was the only credential
• fixed #2614 - show a "waiting" UI on RDP while waiting for admin approval (#2615)