warpgate

v0.26.0 Feature

This release adds 4 notable features for engineering teams evaluating rollout.

Published 25d Secrets & Credentials

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

✓ No known CVEs patched in this version

Topics

bastion bastion-host https https-proxy infrastructure kubernetes

+9 more

mysql mysql-proxy pam postgresql-proxy privileged-access-management proxy rust ssh ssh-server

Affected surfaces

auth rbac

Summary

AI summary

Added brute-force protection, custom SSH banner, global WebSSH toggle, and option to disable password login.

Full changelog

New features

Brute-force protection with IP blocking and user lockout https://github.com/warp-tech/warpgate/pull/1630

by @mrmm

Custom SSH banner https://github.com/warp-tech/warpgate/pull/2125

The new parameter lets you set a custom banner to be displayed when users connect over SSH.

Global toggle for webSSH https://github.com/warp-tech/warpgate/pull/2119

Added an option to disable WebSSH entirely

Option to disable password login https://github.com/warp-tech/warpgate/pull/2128

Added an option to disable the password login form entirely, allowing only SSO authentication.

Changes

Add configurable roles_claim for custom OIDC providers by @noammeltzer-ax in https://github.com/warp-tech/warpgate/pull/2113
- Lets you sync roles from OIDC providers that do not support custom claim names
fixed #2112 - support receiving pre-expired cookies from upstream by @Eugeny in https://github.com/warp-tech/warpgate/pull/2126
- Upstream cookies that with an expiration date in the past are not passed through as-is
fixed #2066 - offer hmac-sha1 when insecure algorithms are allowed by @Eugeny in https://github.com/warp-tech/warpgate/pull/2127
- Enabling "Insecure ciphers" for an SSH target now also enables the hmac-sha1 MAC algorithm, which was previously never enabled.
ci(docker): sign and attest (SBOM, provenance) the published image by @mathieuHa in https://github.com/warp-tech/warpgate/pull/2090
Warn on unknown/misplaced config keys instead of silently dropping them by @ndreno in https://github.com/warp-tech/warpgate/pull/2099

Fixes

Terminate HTTP target WebSockets on logout by @snvtac in https://github.com/warp-tech/warpgate/pull/2111
fixed #2027 - case-insensitive username comparison for web approval by @Eugeny in https://github.com/warp-tech/warpgate/pull/2117
fixed #2103 - do not auto-advance login state to SSO on invalid password by @Eugeny in https://github.com/warp-tech/warpgate/pull/2118

New Contributors

@ndreno made their first contribution in https://github.com/warp-tech/warpgate/pull/2099
@snvtac made their first contribution in https://github.com/warp-tech/warpgate/pull/2111
@noammeltzer-ax made their first contribution in https://github.com/warp-tech/warpgate/pull/2113

Full Changelog: https://github.com/warp-tech/warpgate/compare/v0.25.6...v0.26.0-beta.1

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track warpgate

Get notified when new releases ship.

About warpgate

Fully transparent SSH, HTTPS, Kubernetes, MySQL and Postgres bastion/PAM that doesn't need additional client-side software

All releases →