Executive brief
Shinobi is an open-source video management platform that manages IP and USB cameras across enterprise networks. This vulnerability allows unauthenticated attackers on the network to bypass security controls and directly execute arbitrary database queries by using a hardcoded credential in the child node service, enabling them to read and modify user accounts, camera configurations, and other sensitive video surveillance data.
Technical details
The vulnerability is a hardcoded connection key vulnerability in Shinobi's child node service that fails to require proper authentication. An attacker with network access to the child node port can present the hardcoded key during WebSocket handshake and then dispatch SQL queries through the onWebSocketDataFromChildNode handler to the database. The attack requires network reachability to the child node service port but no prior authentication; successful exploitation allows reading and modifying user records, camera configurations, and other critical application data. The fix is available in commit 5a76c74f and later versions.
Affected products
- Shinobi Systems Shinobi before commit 5a76c74f
Timeline
- 2026-08-29: disclosed