Warpgate 0.29.0 Adds Session Approvals, Fixes Four Advisories

Warpgate, an open-source gateway that proxies SSH, HTTPS, Kubernetes, database and RDP access without client-side software, shipped version 0.29.0 on Friday at 9:04 a.m. UTC, adding just-in-time session approvals and fixing four separate security advisories.

Maintainer Eugene published the release notes on GitHub, warning upfront that "this release contains breaking API changes," and naming the compatible versions of the project's Terraform provider, 1.2.0, and its Kubernetes operator, 0.4.11, for anyone running either against it.

What the new features do

The headline addition, tracked as pull request 2563, lets an administrator mark a target so that every connection to it needs a human approval before it opens, with a configurable timeout and an option to cache an approval so repeat connections do not each need a fresh sign-off. A second feature, pull request 2555, adds a global policy to require or merely prompt for a second authentication factor across every user, with an exemption for accounts that authenticate through single sign-on. A third change gives administrators a default credential policy that new users inherit automatically, editable under the product's Config menu.

The four advisories

Warpgate's release notes list four vulnerabilities fixed in the same build, three of them centered on one failure mode: a user account that gets deleted and later recreated with the same name can still be reached through sessions that were never told the original account was gone.

Advisory	Severity	What it allowed
GHSA-m2h4-9m63-6vqp	Moderate	A stale HTTP session to keep working after its account was deleted and recreated
GHSA-pw7m-635x-pmx7	Moderate	The same flaw, for Kubernetes sessions
GHSA-xr7p-gw3r-m3jx	Moderate	Deleting a user to leave that user's active native-protocol sessions running
GHSA-hrfx-fm67-gv64	Minor	Kubernetes clients to see detailed internal error text, including possible database errors

A fifth fix, tracked as issue 2597 and listed among Warpgate's ordinary bug fixes rather than its numbered advisories, sounds just as sensitive as the four above it: the endpoints for updating a public key or single sign-on credential "allowed moving credentials between users," the notes say, without explaining further or assigning it a GHSA identifier of its own. The release notes also disclose that TOTP secrets generated through the admin interface previously did not use a cryptographically secure random number generator, and that a malformed RDP handshake could pin a CPU core.

What it costs to run

Warpgate is Apache 2.0-licensed and has 7,918 stars on GitHub as of Friday. It asks users for five minutes on a Microsoft Forms survey about what they want from future releases, and says in the same release notes that "multiple changes in this release have been proposed by users" through that channel. The project does not publish a hosted price; it is self-run software, and the cost is the time of whoever administers it, now including the extra step of approving sessions that JIT access requires by design.

Deleting a user now closes every one of that user's active sessions immediately, the notes say, which is the fix for the underlying pattern rather than a one-off patch. Whether that closes the account-recreation gap for good, or whether a sixth variant turns up the way three did in this release alone, is the thing worth checking the next time Warpgate ships. It is the same kind of account-and-session housekeeping this desk covered in GNOME 51's passkey login changes, and it lands in the same week as CISA's three-day patch deadline for two actively exploited Linux kernel flaws, another reminder that access-control fixes rarely ship on their own schedule.