CVE-2026-44426: Shellhub

Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days.

ShellHub is a centralized SSH gateway. Prior to 0.24.2, GET /api/namespaces/:tenant returns the full namespace object — including the members list (user IDs, e-mails, roles), settings, and device counts — to any caller authenticated by an API Key, for any tenant, regardless of the API Key's own tenant scope. The handler conditionally skips the membership check when the user ID (X-ID) is absent, which is exactly the case for API Key authentication. This vulnerability is fixed in 0.24.2.

Affected products

• Shellhub Shellhub: before 0.24.2 (fixed in 0.24.2)

Published 2026-05-13. Last modified 2026-06-17.