Is CVE-2026-44424 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-44424 being exploited in the wild.

How severe is CVE-2026-44424?

Medium severity, with a CVSS score of 6.5, published 13 May 2026.

Which products and versions are affected?

github.com/shellhub-io/shellhub (Go) <= 0.24.1, SEMVER:introduced=0,fixed=0.24.2; ShellHub < 0.24.2, <= 0.24.1.

Is there a fix for CVE-2026-44424?

Yes. github.com/shellhub-io/shellhub (Go): upgrade to 0.24.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-44424 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-44424?

Check whether you run github.com/shellhub-io/shellhub (Go) or ShellHub at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-44424: ShellHub authorization bypass in device API

Q: Is there a fix for CVE-2026-44424?

Yes. github.com/shellhub-io/shellhub (Go): upgrade to 0.24.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-44424 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-44424?

Check whether you run github.com/shellhub-io/shellhub (Go) or ShellHub at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-44424 · Severity: medium · CVSS 6.5 · Published 2026-05-13

ShellHub, a centralized gateway for managing SSH access to remote devices, contains a security flaw that allows users to view device information belonging to other organizations. An authenticated user can bypass security boundaries to access sensitive metadata—such as hostnames, network addresses, and encryption keys—of devices they do not own. This could lead to unauthorized reconnaissance and targeted attacks against a company's infrastructure.

Technologies: github.com/shellhub-io/shellhub (Go), ShellHub. Vendors: Go, ShellHub.

Quick answers

Is CVE-2026-44424 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-44424 being exploited in the wild.
How severe is CVE-2026-44424?: Medium severity, with a CVSS score of 6.5, published 13 May 2026.
Which products and versions are affected?: github.com/shellhub-io/shellhub (Go) <= 0.24.1, SEMVER:introduced=0,fixed=0.24.2; ShellHub < 0.24.2, <= 0.24.1.
Is there a fix for CVE-2026-44424?: Yes. github.com/shellhub-io/shellhub (Go): upgrade to 0.24.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-44424 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-44424?: Check whether you run github.com/shellhub-io/shellhub (Go) or ShellHub at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/shellhub-io/shellhub (Go): upgrade to 0.24.2 or later
```
go get github.com/shellhub-io/shellhub@v0.24.2
```

Technical details

An Insecure Direct Object Reference (IDOR) vulnerability exists in the ShellHub API due to improper authorization checks in the device retrieval logic. Specifically, the 'GetDevice' function in 'api/services/device.go' resolves device objects by UID without scoping the query to the caller's tenant namespace. While the 'Authorize' middleware ensures a valid session exists, it fails to validate ownership of the requested resource. An attacker with a valid JWT or API key can retrieve full device metadata—including MAC addresses, public SSH keys, OS fingerprints, and remote IP addresses—by supplying a target device UID to the 'GET /api/devices/:uid' endpoint. This issue is resolved in version 0.24.2 by enforcing namespace-based filtering during device resolution.

Affected products

ShellHub ShellHub < 0.24.2

Identifiers

CVE-2026-44424
GHSA-j72x-xfwg-783f
GO-2026-5453

Timeline

2026-04-29: advisory: GitHub security advisory published by maintainers
2026-05-13: disclosed: CVE-2026-44424 published to NVD

References

https://github.com/shellhub-io/shellhub/security/advisories/GHSA-j72x-xfwg-783f

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.