Executive brief
ShellHub, a centralized gateway for managing SSH access to remote devices, contains a security flaw that allows users to view device information belonging to other organizations. An authenticated user can bypass security boundaries to access sensitive metadata—such as hostnames, network addresses, and encryption keys—of devices they do not own. This could lead to unauthorized reconnaissance and targeted attacks against a company's infrastructure.
Technical details
An Insecure Direct Object Reference (IDOR) vulnerability exists in the ShellHub API due to improper authorization checks in the device retrieval logic. Specifically, the 'GetDevice' function in 'api/services/device.go' resolves device objects by UID without scoping the query to the caller's tenant namespace. While the 'Authorize' middleware ensures a valid session exists, it fails to validate ownership of the requested resource. An attacker with a valid JWT or API key can retrieve full device metadata—including MAC addresses, public SSH keys, OS fingerprints, and remote IP addresses—by supplying a target device UID to the 'GET /api/devices/:uid' endpoint. This issue is resolved in version 0.24.2 by enforcing namespace-based filtering during device resolution.
Affected products
- ShellHub ShellHub < 0.24.2
Timeline
- 2026-04-29: advisory: GitHub security advisory published by maintainers
- 2026-05-13: disclosed: CVE-2026-44424 published to NVD