CVE-2026-44425 Details
Description
ShellHub is a centralized SSH gateway. Prior to 0.24.2, the device list endpoint accepts user-controlled identifiers in the the name field of each filter property in the base64-encoded filter query parameter and the sort_by query parameter, which are then passed directly as BSON/SQL keys in the database layer without validation. Any authenticated user can craft payloads that cause the aggregation / query to fail and the API to return HTTP 500 with no body, with no rate limiting applied. This vulnerability is fixed in 0.24.2.
A vulnerability in ShellHub, a centralized SSH gateway, allows any authenticated user to cause the device list endpoint to return an HTTP 500 error. This issue is present in versions through 0.24.1. The vulnerability arises because the endpoint accepts user-controlled identifiers in the filter and sort-by query parameters, which are then passed directly to the database layer as BSON/SQL keys without proper validation. This lack of input validation enables users to inject MongoDB operators and other special elements that can disrupt the API's aggregation/query process, leading to a server error. Additionally, the vulnerability could be exploited to bypass rate limiting and generate log noise, complicating forensic analysis.
The vulnerability has been fixed in ShellHub version 0.24.2. Users should update to this version.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/shellhub-io/shellhub/security/advisories/GHSA-47r2-v3x6-wff9 | [email protected] | ExploitMitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1333 | Inefficient Regular Expression Complexity | [email protected] |
| CWE-20 | Improper Input Validation | [email protected] |
| CWE-943 | Improper Neutralization of Special Elements in Data Query Logic | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| shellhub shellhub | < 0.24.2 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 18, 2026 | Initial Analysis | [email protected] |
| May 13, 2026 | New CVE Received | [email protected] |