Excessive Data Exposure in ShellHub Centralized SSH Gateway
CVE-2026-44426

6.5MEDIUM

Key Information:

Vendor

Shellhub-io

Status
Shellhub
Vendor
CVE Published:
13 May 2026

What is CVE-2026-44426?

Prior to version 0.24.2, ShellHub's centralized SSH gateway contained an improper access control vulnerability. Specifically, the API endpoint GET /api/namespaces/:tenant was found to return the full namespace object, including sensitive information such as member user IDs, email addresses, roles, settings, and device counts, to any caller authenticated by an API Key. This vulnerability arose because the membership check was conditionally bypassed when the user ID (X-ID) was not present, which was the case for API Key authentication. This flaw compromised tenant-specific data, granting unauthorized access to multiple tenants. The issue has been addressed in version 0.24.2.

Affected Version(s)

shellhub < 0.24.2

References

https://github.com/shellhub-io/shellhub/security/advisori...
x_refsource_CONFIRM

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.