CVE-2026-44423: medium-severity vulnerability in shellhub-io shellhub
ShellHub: Cross-tenant IDOR in `GET /api/sessions/:uid` discloses SSH session data
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 6.5epss 0.2%
ShellHub is a centralized SSH gateway. Prior to 0.24.2, GET /api/sessions/:uid returns the full session object for any authenticated caller, without scoping by the caller's tenant. An authenticated user can read session records (SSH username, device UID, remote IP, terminal type, authenticated flag, timestamps) belonging to any other namespace. This vulnerability is fixed in 0.24.2.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected products
shellhub-io · shellhubRelated CVEs — shellhub-io shellhub
In the same product, most dangerous first.
CVE-2026-44426MEDIUMShellHub: Cross-tenant IDOR in `GET /api/namespaces/:tenant` via API Key bypasses membership checkEPSS 0.3%CVE-2026-44425MEDIUMShellHub: Crash-DoS via field injection in filter and sort-by parametersEPSS 0.3%CVE-2026-44424MEDIUMShellHub: Cross-tenant IDOR in `GET /api/devices/:uid` discloses device data of any namespaceEPSS 0.2%