CVE-2026-44426 Details
Description
ShellHub is a centralized SSH gateway. Prior to 0.24.2, GET /api/namespaces/:tenant returns the full namespace object — including the members list (user IDs, e-mails, roles), settings, and device counts — to any caller authenticated by an API Key, for any tenant, regardless of the API Key's own tenant scope. The handler conditionally skips the membership check when the user ID (X-ID) is absent, which is exactly the case for API Key authentication. This vulnerability is fixed in 0.24.2.
A vulnerability exists in ShellHub, a centralized SSH gateway, in versions prior to 0.24.2. The issue arises in the `GET /api/namespaces/:tenant` endpoint, where the full namespace object is returned to any caller authenticated by an API Key, regardless of the API Key's tenant scope. This response includes sensitive information such as the members list (user IDs, emails, roles), settings, and device counts. The vulnerability occurs because the membership check is skipped for API Key authentication, allowing cross-tenant data access.
Users are advised to update to ShellHub version 0.24.2 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/shellhub-io/shellhub/security/advisories/GHSA-vwx9-7qcf-gg7f | CISA-ADP | ExploitVendor Advisory |
| https://github.com/shellhub-io/shellhub/security/advisories/GHSA-vwx9-7qcf-gg7f | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-639 | Authorization Bypass Through User-Controlled Key | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| shellhub shellhub | < 0.24.2 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 14, 2026 | Initial Analysis | [email protected] |
| May 14, 2026 | CVE Modified | CISA-ADP |
| May 13, 2026 | New CVE Received | [email protected] |