# CVE-2026-44424: ShellHub authorization bypass in device API

Source: https://junglewise.ai/threats/cve-2026-44424-shellhub-authorization-bypass-in-device-api  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-13. Updated: 2026-05-18  
License: CC BY 4.0 with a link back

CVE-2026-44424 · Severity: medium · CVSS 6.5 · Published 2026-05-13

ShellHub, a centralized gateway for managing SSH access to remote devices, contains a security flaw that allows users to view device information belonging to other organizations. An authenticated user can bypass security boundaries to access sensitive metadata—such as hostnames, network addresses, and encryption keys—of devices they do not own. This could lead to unauthorized reconnaissance and targeted attacks against a company's infrastructure.

Technologies: [github.com/shellhub-io/shellhub (Go)](https://junglewise.ai/threats/technologies/github-com-shellhub-io-shellhub), [ShellHub](https://junglewise.ai/threats/technologies/shellhub). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [ShellHub](https://junglewise.ai/threats/vendors/shellhub).

## Quick answers

**Is CVE-2026-44424 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-44424 being exploited in the wild.

**How severe is CVE-2026-44424?** Medium severity, with a CVSS score of 6.5, published 13 May 2026.

**Which products and versions are affected?** github.com/shellhub-io/shellhub (Go) <= 0.24.1, SEMVER:introduced=0,fixed=0.24.2; ShellHub < 0.24.2, <= 0.24.1.

**Is there a fix for CVE-2026-44424?** Yes. github.com/shellhub-io/shellhub (Go): upgrade to 0.24.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-44424 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-44424?** Check whether you run github.com/shellhub-io/shellhub (Go) or ShellHub at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/shellhub-io/shellhub (Go): upgrade to 0.24.2 or later

  ```sh
  go get github.com/shellhub-io/shellhub@v0.24.2
  ```


## Technical details

An Insecure Direct Object Reference (IDOR) vulnerability exists in the ShellHub API due to improper authorization checks in the device retrieval logic. Specifically, the 'GetDevice' function in 'api/services/device.go' resolves device objects by UID without scoping the query to the caller's tenant namespace. While the 'Authorize' middleware ensures a valid session exists, it fails to validate ownership of the requested resource. An attacker with a valid JWT or API key can retrieve full device metadata—including MAC addresses, public SSH keys, OS fingerprints, and remote IP addresses—by supplying a target device UID to the 'GET /api/devices/:uid' endpoint. This issue is resolved in version 0.24.2 by enforcing namespace-based filtering during device resolution.

## Affected products

- ShellHub ShellHub < 0.24.2

## Identifiers

- CVE-2026-44424
- GHSA-j72x-xfwg-783f
- GO-2026-5453

## Timeline

- 2026-04-29: advisory: GitHub security advisory published by maintainers
- 2026-05-13: disclosed: CVE-2026-44424 published to NVD

## References

- [https://github.com/shellhub-io/shellhub/security/advisories/GHSA-j72x-xfwg-783f](https://github.com/shellhub-io/shellhub/security/advisories/GHSA-j72x-xfwg-783f)

## Related threats

- [ShellHub authorization bypass in namespace API via API Key authentication](https://junglewise.ai/threats/cve-2026-44426-shellhub-authorization-bypass-in-namespace-api-via-api-key)
- [ShellHub field injection in device list endpoint](https://junglewise.ai/threats/cve-2026-44425-shellhub-field-injection-in-device-list-endpoint)
- [ShellHub IDOR in session API allows cross-tenant data disclosure](https://junglewise.ai/threats/cve-2026-44423-shellhub-idor-in-session-api-allows-cross-tenant-data-disclosure)