CVE-2026-63330

Description

Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.25.6, api_get_recording_stream in warpgate-admin/src/api/recordings_detail.rs protects /@warpgate/admin/api/recordings/{uuid}/stream only with session authentication and omits require_admin_permission for AdminPermission::RecordingsView. Any authenticated regular user who identifies an active recording can subscribe to its WebSocket and receive real-time terminal input and output from proxied SSH, MySQL, or PostgreSQL sessions, including credentials, commands, and other sensitive data belonging to users and administrators. This issue is fixed in version 0.25.6.

Overview

State: PUBLISHED
Assigner (CNA): GitHub_M
CVSS severity: HIGH
CVSS score: 7.7 / 10
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Effective score: 7.7 / 10 HIGH source: CNA overview
CWE(s): CWE-285, CWE-862
Reserved: 2026-07-16
Published: 2026-09-21 18:49 UTC
Last updated: 2026-09-21 18:49 UTC
Source: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/63xxx/CVE-2026-63330.json
Linked Threat: CVE-2026-63330 — Warpgate: Missing Admin Authorization on Live Recording Stream WebSocket Allows Any Authenticated User to Eavesdrop on Terminal Sessions

NVD triage scoring NVD CVE 2.0

Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.

NVD published: 2026-09-21 19:17:08 UTC
NVD last modified: 2026-09-21 19:17:08 UTC
NVD CVSS v3.1: 7.7 / 10 HIGH source: security-advisories@github.com
NVD CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Exploitability subscore: 3.1 / 10
Impact subscore: 4.0 / 10

European Union Vulnerability Database ENISA EUVD

ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.

EUVD ID: EUVD-2026-84061
Assigner: GitHub_M
Published: Sep 21, 2026, 6:49:45 PM
Updated: Sep 21, 2026, 6:49:45 PM
EUVD base score (CVSS 3.1): 7.7 / 10
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
EUVD-reported EPSS: 0.0000
Vendors: warp-tech
Products: warpgate (< 0.25.6)

ENISA description: Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.25.6, api_get_recording_stream in warpgate-admin/src/api/recordings_detail.rs protects /@warpgate/admin/api/recordings/{uuid}/stream only with session authentication and omits require_admin_permission for AdminPermission::RecordingsView. Any authenticated regular user who identifies an active recording can subscribe to its WebSocket and receive real-time terminal input and output from proxied SSH, MySQL, or PostgreSQL sessions, including credentials, commands, and other sensitive data belonging to users and administrators. This issue is fixed in version 0.25.6.

EUVD references (3)

Affected products (1)

Vendor	Product	Versions	Platforms
warp-tech	warpgate	`< 0.25.6` (affected)	—

Vendor references (3)

References embedded in the original CVE record by the assigning CNA.

https://github.com/warp-tech/warpgate/security/advisories/GHSA-2q37-6vxr-26jr x_refsource_CONFIRM
https://github.com/warp-tech/warpgate/commit/f5cb06ea09065f375870ccee64fe721a2ca79766 x_refsource_MISC
https://github.com/warp-tech/warpgate/releases/tag/v0.25.6 x_refsource_MISC

Web references (0)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

No web references attached yet.

NVD-tagged references (3)

Reference list NVD curates from the CNA record, vendor advisories, and third-party reports. The tag chips below are NVD's analyst-assigned categories.

https://github.com/warp-tech/warpgate/commit/f5cb06ea09065f375870ccee64fe721a2ca79766 security-advisories@github.com
https://github.com/warp-tech/warpgate/releases/tag/v0.25.6 security-advisories@github.com
https://github.com/warp-tech/warpgate/security/advisories/GHSA-2q37-6vxr-26jr security-advisories@github.com

Remediations (10)

Remediations are stored against the linked Threat row; the list below is deduplicated across both pages.

WordPress Remote Code Execution Vulnerability (CVE-2026-63030/CVE-2026 ...

web:securityboulevard.com

Join the web's most supportive community of creators and get high-quality tools for hosting, sharing, and streaming videos in gorgeous HD with no ads.

2026-09-22 16:47 UTC
WordPress wp2shell (CVE-2026-63030): CISO FAQ & Fix

web:socradar.io

You can also run SOCRadar's free wp2shell checker to test a domain directly on this page. SOCRadar's Vulnerability Intelligence tracks CVE - 2026 -63030 and CVE - 2026 -60137 with exploit status and mitigation guidance as the situation develops, so security teams can prioritize patching before attackers weaponize the full chain further.

2026-09-22 16:47 UTC
WordPress wp2shell Vulnerabilities Exploited in the Wild (CVE-2026 ...

web:threatprotect.qualys.com

Threat actors have released public exploit code for the WordPress core remote code execution vulnerabilities, named wp2shell. Tracked as CVE - 2026 -63030 and CVE - 2026 -60137, the vulnerabilities can be…

2026-09-22 16:47 UTC
CVE-2026-63030 and CVE-2026-60137: Mitigating a Critical ...

web:www.akamai.com

Learn about CVE - 2026 -63030 and CVE - 2026 -60137, a critical unauthenticated RCE chain in WordPress Core. Understand the attack surface and how to stay protected.

2026-09-22 16:47 UTC
WP2Shell (CVE-2026-63030): Checker, Patch & Detection Guide

web:www.cyberkendra.com

01 Is my site affected? (Instant checker) 02 The facts at a glance 03 How WP2Shell actually works (in plain English) 04 It's being exploited right now (in-the-wild data) 05 Patch it — the 5-minute fix (do this first) 06 Can't patch right now? Emergency mitigations 07 Were you already hit? Detection & log-hunting 08 Indicators of Compromise (IOC) 09 Public PoC code & research resources 10 ...

2026-09-22 16:47 UTC
CVE-2026-63030 and CVE-2026-60137 (wp2shell): WordPress RCE Explained

web:www.picussecurity.com

wp2shell is an unauthenticated WordPress core RCE chain. Learn how it works, who is affected, and how to defend against it.

2026-09-22 16:47 UTC
wp2shell: WordPress RCE Chain CVE-2026-63030 Explained

web:www.prophaze.com

wp2shell chains CVE - 2026 -63030 and CVE - 2026 -60137 into unauthenticated WordPress RCE. Learn how it works, who's exposed, and how to patch or block it.

2026-09-22 16:47 UTC
CVE-2026-63030: wp2shell a Critical Remote Code Execution ... - Rapid7

web:www.rapid7.com

On July 17, 2026 , a GitHub Security Advisory was published for CVE - 2026 -63030, a critical unauthenticated remote code execution vulnerability affecting WordPress Core.

2026-09-22 16:47 UTC
CVE-2026-6330 - Info Vulnerability (PoC Available) - TheHackerWire

web:www.thehackerwire.com

How do I fix or mitigate CVE - 2026 -6330? To protect against CVE - 2026 -6330, you should: (1) Apply the latest security patches from Wolfssl, (2) Check official security advisories for specific remediation steps, (3) Update affected software to the latest version, and (4) Monitor your systems for any signs of exploitation.

2026-09-22 16:47 UTC
Exploitation in the Wild of wp2shell | Wiz Blog

web:www.wiz.io

Wiz Research has identified exploitation of "wp2shell", a critical pre-auth RCE vulnerability chain impacting WordPress Core ( CVE - 2026 -63030 & CVE - 2026 -60137). Attackers are deploying persistent webshells on vulnerable servers. Organizations should prioritize patching or applying WAF mitigations .

2026-09-22 16:47 UTC

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.

Raw JSON

The full cvelistV5 record. Download as CVE-2026-63330.json.

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "warpgate",
          "vendor": "warp-tech",
          "versions": [
            {
              "status": "affected",
              "version": "< 0.25.6"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.25.6, api_get_recording_stream in warpgate-admin/src/api/recordings_detail.rs protects /@warpgate/admin/api/recordings/{uuid}/stream only with session authentication and omits require_admin_permission for AdminPermission::RecordingsView. Any authenticated regular user who identifies an active recording can subscribe to its WebSocket and receive real-time terminal input and output from proxied SSH, MySQL, or PostgreSQL sessions, including credentials, commands, and other sensitive data belonging to users and administrators. This issue is fixed in version 0.25.6."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-285",
              "description": "CWE-285: Improper Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862: Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-21T18:49:45.500Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/warp-tech/warpgate/security/advisories/GHSA-2q37-6vxr-26jr",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/warp-tech/warpgate/security/advisories/GHSA-2q37-6vxr-26jr"
        },
        {
          "name": "https://github.com/warp-tech/warpgate/commit/f5cb06ea09065f375870ccee64fe721a2ca79766",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/warp-tech/warpgate/commit/f5cb06ea09065f375870ccee64fe721a2ca79766"
        },
        {
          "name": "https://github.com/warp-tech/warpgate/releases/tag/v0.25.6",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/warp-tech/warpgate/releases/tag/v0.25.6"
        }
      ],
      "source": {
        "advisory": "GHSA-2q37-6vxr-26jr",
        "discovery": "UNKNOWN"
      },
      "title": "Warpgate: Missing Admin Authorization on Live Recording Stream WebSocket Allows Any Authenticated User to Eavesdrop on Terminal Sessions"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-63330",
    "datePublished": "2026-09-21T18:49:45.500Z",
    "dateReserved": "2026-07-16T14:14:24.384Z",
    "dateUpdated": "2026-09-21T18:49:45.500Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}