{"cve":"CVE-2026-44423","nvd":{"published":"2026-05-13T22:16:44.103","modified":"2026-06-17T10:50:37.360","status":"Analyzed","description":"ShellHub is a centralized SSH gateway. Prior to 0.24.2, GET /api/sessions/:uid returns the full session object for any authenticated caller, without scoping by the caller's tenant. An authenticated user can read session records (SSH username, device UID, remote IP, terminal type, authenticated flag, timestamps) belonging to any other namespace. This vulnerability is fixed in 0.24.2.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","score":6.5},"cwes":["CWE-639"],"references":["https://github.com/shellhub-io/shellhub/security/advisories/GHSA-9w9c-9w8m-w89q","https://github.com/shellhub-io/shellhub/security/advisories/GHSA-9w9c-9w8m-w89q"],"products":["shellhub:shellhub"],"source":"nvd","synced_at":"2026-10-19T22:35:16.954578616+00:00"},"epss":{"cve":"CVE-2026-44423","score":0.00246,"percentile":0.15866,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-9w9c-9w8m-w89q","url":"https://osv.dev/vulnerability/GHSA-9w9c-9w8m-w89q","summary":"ShellHub has cross-tenant IDOR in `GET /api/sessions/:uid` that discloses SSH session data","modified":"2026-07-21T13:57:29Z","packages":[{"ecosystem":"Go","name":"github.com/shellhub-io/shellhub","purl":"pkg:golang/github.com/shellhub-io/shellhub","ranges":["<0.24.2"],"fixed":["0.24.2"]}]},{"id":"GO-2026-5302","url":"https://osv.dev/vulnerability/GO-2026-5302","summary":"ShellHub has cross-tenant IDOR in `GET /api/sessions/:uid` that discloses SSH session data in github.com/shellhub-io/shellhub","modified":"2026-06-25T19:45:32.485146768Z","packages":[{"ecosystem":"Go","name":"github.com/shellhub-io/shellhub","purl":"pkg:golang/github.com/shellhub-io/shellhub","ranges":["<0.24.2"],"fixed":["0.24.2"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}